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port 22: A! open (port not listen) [2 
port 23: A! open (port listen) [217.41.132.161] 
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port 25: A! open (port not listen) 
port 53: A! open (port not listen) ; A 2 
port 80: A! open (port not listen) [217.41.132.161] 
Scan completed successfully. 
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In this example you can see that ports 21 and 23 are both open and something is listening 
behind those ports. The other ports are just open and nothing is behind them based on 
the results returned. 


If you look up higher in the results, you’ll see the Ramping phase. In this step the 
firewalking script is using traceroute to see how many hops it takes to get to the target. 
Once this number is determined to be 3, Firewalk adds one hop to bring it to 4 and limits 
or sets the bounds of the scan at 4 hops. By doing this the scanner can tell if packets got 
to the point past the firewall or were stopped by the firewall. 


Let’s take Firewalk for a drive and see how to use it in practice; see Exercise 17.1. 


EXERCISE 17.1 


Come Firewalk with Kali 


In this exercise you will use Kali and the Firewalk script to target a firewall and try to 
determine the configuration of the firewall in place. To complete this exercise you 
will need to be running Kali and have a firewalled system on your network or have 
permission to scan. 


To use Firewalk, follow these steps: 
1. At the Kali terminal window enter the following command: 


firewalk -S1-1024 -i <interface> -n -pTCP <gateway IP> <target IP> 


. In this example —S states which ports to scan, -i is the network interface to scan 
with, -n states no reverse name resolution, and -p says to use TCP for the scan. 
The last two are the address of the gateway or firewall, and target IP is the point 
behind the firewall. Populate these with the appropriate values for your 
environment. 


. Press Enter. 


The Firewalk script will now be running and will provide results after a few 
moments. 


After Firewalk completes take a look at the results and you should be able to get 
an idea of how traffic is handled. You should see which ports are open as well as 
which ones have something listening behind them or not. 





One thing I haven’t mentioned in relation to firewalking is what you should do once you 
find open ports. In practice, once an attacker finds open ports they could now focus on 
those ports and configure their tools to get into the system through them. There is 
another benefit to finding these open ports on the firewall. Ports that are open by design 
of the system owner may not perform any sort of logging on traffic that passes through 
them. 


Using Nmap to Determine a Firewall’s Configuration 


As we have seen time and time again, Nmap is capable of doing many things, and in this 
case it can also perform firewalking. In practice, this means that the TTL value of packets 
is configured to one step past the firewall. If the probe passes the firewall and hits the 
next router, the TTL is decremented by 1 and an ICMP_TIME_ EXCEEDED message is 
returned. 


It starts with a TTL equal to the distance to the target. If the probe times out, it is re-sent 
with a TTL decreased by 1. If you get an ICMP_TIME_EXCEEDED, then the scan is over 
for this probe, meaning that the port is closed. 


To make this even more effective Nmap has a built-in script that will perform firewalking 
for you. You can call this script and target a victim using the following syntax: 


nmap --script=firewalk --traceroute <target ip-address> 


In this example, --script= specifies the script to use. The next switch, --traceroute, 
executes a traceroute to the target IP address in order to determine the bounds for the 
firewalking process. 


Mobile Devices and Firewalls 


In the past firewalls protected networks as well as hosts on the network in the form of 
personal firewalls, but now mobile devices have the same problems that hosts had in the 
past. Thus we now have firewalls for mobile devices. The Google Play store, for example, 
is filled with different quality firewalls, some that are free and some that cost. This is the 
case for Apple’s devices as well. 


P “ For more information on mobile devices and the vulnerabilities as well as 


defenses available, refer to Chapter 16, “Mobile Device Security.” 





Honeypots 


One of the more interesting systems you will encounter is a honeypot. A honeypot may 
sound like something out of a Winnie the Pooh book, but it is actually a device or system 
used to attract and trap attackers who are trying to gain access to a system. However, 
honeypots are far from being just a booby trap; they have also been used as research 
tools, as decoys, and just to gain information. They are not designed to address any 
specific security problem. 


Honeypots don’t fit into any neat classification or category. Honeypots can fulfil a 
number of different purposes or roles for an organization, but most agree that a honeypot 
provides value from being used by unauthorized parties or through illicit use. Honeypots 
are designed to be misused and abused and in that role they stand alone. In practice the 
system can appear as any of the following: 


e A dedicated server 

e Asimulated system of some type 

e A service on a host designed to look legitimate 
e A virtual server 

e A single file 


In all these examples the honeypot is configured to look like a real item within the 
environment, but it is anything but that. While a honeypot looks like a real resource and 


may behave that way, it is never intended to be used for any legitimate purpose. If a 
honeypot has any sort of actions in progress on it, then they are more than likely due to 
some sort of unauthorized or accidental use that may even be malicious. 


In some circles a honeypot is viewed as a decoy device, but this is also not entirely correct 
and can be confusing. It is not unheard of for a honeypot to be described as something 
you put in your DMZ with the goal of having someone break into it. In terms of research 
this would be a valid and true statement to make, but it doesn’t hold up upon closer 
inspection. The last thing you want as the owner of a network or the person in charge of 
security is for someone to break into your environment, as would be the case of a decoy in 
the DMZ. Since a DMZ would host systems like web servers, email gateways, or other 
services, you would not want to draw an attacker’s attention in any way to these items. 


i This is not to say that some environments have not employed a honeypot 


as a decoy, but it should not be deployed as the core strategy. A honeypot as a decoy 
has been used to draw intruders away from critical resources, but this requires 
careful planning to avoid problems. 





Using a Honeypot in Practice 


A honeypot is ideally suited to get a clearer picture of the activity on or around the critical 
systems in your environment. The common use of honeypots is to look like a legitimate 
resource so as to be indistinguishable from the real thing. This will subject both the 
honeypot and the real resource to the same activity, meaning that attacks can be detected 
more easily. 


An example of a typical deployment of a honeypot would be one where we have a high- 
traffic web server. In this environment we would put the web server and a honeypot 
configured identically in the DMZ. Since both are the same, the attacks both are exposed 
to in the same location should also match. Any malware, probes, enumeration, or other 
actions would immediately be detectable as a potential attack because the honeypot has 
no legitimate use. This information gathered from the honeypot would allow for the 
design and placement of better defenses. 


High vs. Low Interaction 


Honeypots are not all created equal. There are two main categories: high- and low- 
interaction varieties. 


e Low-interaction honeypots rely on the emulation of service and programs that would 
be found on a vulnerable system. If attacked, the system detects the activity and 
throws an error that can be reviewed by an administrator. 


e High-interaction honeypots are more complex in that they are no longer a single 
system that looks vulnerable but an entire network typically known as a honeynet. 


Any activity that happens in this tightly controlled and monitored environment is 
reported. One other difference in this setup is that in lieu of emulation, real systems 
with real applications are present. 


Honeypots can be easily explored and evaluated as something to consider for your 
environment. Those available include KFSensor, HoneyBOT, and HoneyDrive, to name a 
few. 


Run Silent, Run Deep: Evasion Techniques 


Each of the devices covered in this chapter is designed to stop or slow down an attack. 
Since you, as a penetration tester, are trying to test a system, you must be able to get 
around these devices if possible or at least know how to attempt to do so. In this section 
we discuss the various mechanisms available, how they work, and what devices they are 
designed to deal with. 


Denial of Service vs. IDS 


Another mechanism for getting around an IDS is to attack the IDS directly or exploit a 
weakness in the system via a DoS attack. A DoS or DDoS attack overwhelms or disables a 
target in such a way as to make it temporarily or permanently unavailable. Through the 
consumption of vital system resources, the overall performance of the target is adversely 
impacted, making it less able—or completely unable—to respond to legitimate traffic or at 
least not function to the best of its ability. 


If we target an IDS with a DoS attack, something interesting happens: The IDS functions 
erratically or not at all. To understand this, think of what an IDS is doing and how many 
resources it needs to do its job. An IDS is sniffing traffic and comparing that traffic to 
rules, which takes a considerable amount of resources to perform. If these resources can 
be consumed by another event, then it can have the effect of changing the behavior of the 
IDS. By using enumeration and system hacking methods it is possible for an attacker to 
identify which resources are under load or are vital to the proper functioning of the IDS. 
Once those resources are identified, the attacker can clog up or consume the resources to 
make the IDS not function properly or become occupied by useless traffic. 


Attacks such as the ping of death, teardrop attacks, SYN floods, Smurf Attacks, and 
Fraggle Attacks can be used to perform a DoS against an NIDS. 


Insertion 


An insertion attack is an effective method of defying detection by an IDS. In practice the 
insertion attack relies on knowledge of how the system works and how it will react to 
packets on the network. Essentially, the insertion attack relies on the fact that an IDS can 
accept packets that the actual intended recipient would otherwise accept. If an IDS does 
accept a packet that the end system rejected, then it can be fooled into believing that the 
end system did accept the packet as well. An attacker can take advantage of this situation 
by sending packets to an end system that the IDS accepts. Because of the way an IDS 


works, by sniffing all traffic and comparing it to what knowledge it has in order to detect 
attacks, it will accept all traffic. Since it will accept all packets that other systems won't, it 
is possible to overwhelm or defeat it and get an attack past the IDS. 


In practice, an insertion attack is effective against IDSs that use signature analysis to 
identify malicious activity. 


Another way to carry out this attack is to tamper with the header of a packet. Adjusting 
values such as TTL, the flags, size, or other information can cause a packet to get rejected 
by an end system but not by the IDS. 


Obfuscating 


Because an IDS relies on being able to observe or read information, the process of 
obscuring or obfuscating code can be an effective evasion technique. This technique relies 
on manipulating information in such a way that the IDS cannot comprehend or 
understand it but the target can. You can accomplish this via manual manipulation of 
code or through the use of an obfuscator. One example that has been successful against 
older IDSs is the use of Unicode. By changing standard code such as HTTP requests and 
responses to their Unicode equivalents, you can produce code that the web server 
understands but the IDS may not. 


Want to cover up your scanning activities by placing entries in the firewalls’ logs? Easy— 
just use Nmap to make the firewalls believe that the scan is coming from different 
locations. Nmap has the ability (through the —D switch) to generate decoys, meaning that 
detection of the actual scanning system becomes much more difficult: 


nmap -D RND:10 <target ip> (Generates a random number of decoys) 


Crying Wolf 


Remember the story from your childhood of the boy who cried wolf? The shepherd boy in 
the story cried wolf so many times as a joke that when the wolf was actually attacking his 
flock, no one believed him and his flock got eaten. The moral of the story is that liars are 
rewarded with disbelief from others even when they tell the truth. How does this apply to 
our IDS discussion? Essentially the same way as the boy in the story: An attacker can 
target the IDS with an actual attack, causing it to react to the activity and alert the system 
owner. If done repeatedly, the owner of the system will see log files full of information 
that says an attack is happening, but no other evidence suggests the same. Eventually the 
system owner may start to ignore these warnings, or what they perceive to be false 
positives, and become lax in their observations. Thus an attacker can strike at their actual 
target in plain sight. 


Session Splicing 


The type of evasion technique known as session splicing is an IDS evasion technique that 
exploits the fact that some types of IDSs don’t reassemble or rebuild sessions before 


analyzing traffic. In addition, it is possible to fool some systems by fragmenting packets 
or tampering with the transmission of packets in such a way that the IDS cannot analyze 
them and instead forwards them to the target host. 


vet Tampering with the fragmentation of a packet can be a tremendously 
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effective way of evading an IDS. An example would be to adjust the fragments such 
that when they are reassembled they overlap, causing problems for the IDS, which 
again may result in the fragments being forwarded to the intended target. 





Fun with Flags 


The Transmission Control Protocol uses flags on packets to describe the status of the 
packet. Knowledge of these flags can yield benefits such as evasion techniques for IDSs. 


Bogus RST 


RST is one of the many flags used to end two-way communications between endpoints. In 
addition to these flags, checksums are used to verify the integrity of the packet to ensure 
that what was received is what was sent originally. An attacker can use alteration of this 
checksum to cause the IDS to not process the packet. What happens with some IDSs is 
that upon receipt of an invalid checksum, processing stops and the traffic passes 
unimpeded by the IDS without raising an alert. 


Sense of Urgency 


The URG flag is used to mark data as being urgent in nature. Packets flagged with the 
URG bit set are processed immediately by “jumping” to the front of the “line” ahead of 
other packets. Some IDSs do not take this previous data into account and let it pass 
unimpeded, letting an attack potentially pass without hindrance. 


Encryption 

Some IDSs cannot process encrypted traffic and therefore will let it pass. Of all the 
evasion techniques, encryption is one of the most effective. 

Evading Firewalls 


Earlier you learned what a firewall is capable of doing and the different types that exist. 
So how does an attacker evade these devices? A handful of techniques are available. 


IP Address Spoofing 


One effective way an attacker can evade a firewall is to appear as something else, such as 
a trusted host. Using spoofing to modify address information, the attacker can make the 
source of an attack appear to come from someplace other than the malicious party. 


While this attack can be effective, there are some limitations that may thwart this 
process. The more obvious one is the fact that firewalls will more than likely drop traffic 
that would fit the definition here. Specifically, a trusted host may be something inside 
the network itself. Any sort of specially crafted packet from an IP address range on the 
local network but coming from outside the network will get dropped as invalid. 


Source Routing 


Using this technique, the sender of the packet designates the route that a packet should 
take through the network in such a way that the designated route should bypass the 
firewall node. Using this technique, the attacker can evade the firewall restrictions. 


Through the use of source routing, it is entirely possible for the attacker or sender of a 
packet to specify the route they want it to take instead of leaving such choices up to the 
normal routing process. In this process the origin or source of a packet is assumed to 
have all the information it needs about the layout of a network and can therefore specify 
its own best path for getting to its destination. 


By employing source routing, an attacker may be able to reach a system that would not 
normally be reachable. These systems could include those with private IP addresses or 
those that are protected under normal conditions from the Internet. The attacker may 
even be able to perform IP spoofing, further complicating detection and tracing of the 
attack by making the packet’s origin unknown or different from its actual origin. 


Fortunately, the easiest way to prevent source routing is to configure routers to ignore 
any source routing attempts on the privately controlled network. 


Fragmentation 


The attacker uses the IP fragmentation technique to create extremely small fragments 
and force the TCP header information into the next fragment. This may result in a case 
where the TCP flags field is forced into the second fragment, while filters can check these 
flags only in the first octet. Thus, the IDS ignores the TCP flags. 


To cause fragmentation of traffic in Nmap you could use the following command: 


Nmap -sS -sV -f <ip address or hostname of target> 


Note that the —f instructs Nmap to break the scan being performed here into 8-byte 
fragments, which may be able to pass by defensive measures between the scanner and the 
target. 


Two forms of fragmentation can be used to defeat an IDS, which are issues relating to 
reassembly and overlapping fragments. 


In the first case, reassembly of fragments is exploited by an attacker fragmenting traffic 
intentionally. Under normal conditions the fragments are received by the intended host, 
and because each fragment is numbered, the host knows how to reassemble them. 

However, to fool an IDS an attacker can exploit a weakness in some IDSs by sending the 


packets out of order, which some IDSs cannot deal with. It is also possible to fragment 
traffic, but by only sending some of the fragments, the IDS must buffer the fragments 
until the last bit arrives. The problem here is that they never arrive and the IDS will store 
them in memory while it waits. If an attacker does this with enough traffic, memory will 
be used up on the IDS. 


In the case of overlapping fragments, the IDS is forced to deal with fragments that won’t 
reassemble the right way. This means that the fragments may overlap or not otherwise fit 
together, so the IDS will fail when trying to deal with them. 


IP Addresses to Access Websites 


A mechanism that is effective in some cases at evading or bypassing a firewall is the use 

of an IP address in place of a URL. Since some firewalls look only at URLs instead of the 
actual IP addresses, using the address to access a website can allow an attacker to bypass 
the device. 


ret Mechanisms such as host2ip can convert a URL to an IP address, 
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potentially allowing this address to be used in a browser to bypass the firewall. 





Other mechanisms that are somewhat similar to this technique are using website 
anonymizers and open public proxy servers to get around the firewalls or website 
restrictions of a company. 


ICMP Tunneling 


Yet another method to bypass or evade a firewall is through the use of ICMP tunneling. 
ICMP can be used to bypass a firewall through a little-known part of the RFC 792 
specification (responsible for defining the operation of ICMP). ICMP defines the format 
and structure of the packet but not what the packet carries as part of its data portion. Due 
to this ambiguous definition of the data portion, the contents can be completely arbitrary, 
thus allowing a diverse range of items to be included within the data section. This section 
can include information regarding applications that can open a covert channel or plant 
malware. The result can be that an organization’s firewalls are opened. 


One tool that is effective at performing this type of task is Loki, which has the ability to 
tunnel commands within an ICMP echo packet. Other similar tools are NCovert and 
oo7shell, both of which allow crafting of packets that can be used to bypass a firewall. 


ACK Tunneling 


Pursuing a variation of a theme, you can also use ACK tunneling to bypass the scrutiny of 
a firewall. ACK tunneling exploits the fact that some firewalls do not check packets that 
have the ACK bit configured. The reason for this lapse is that the ACK packet is used to 
respond to previous, and assumed legitimate, traffic that has already been approved. 


An attacker can leverage this flaw by sending packets with the ACK flag set using a tool 
such as AckCmd. 
HTTP Tunneling 


An additional variation of the tunneling method involves exploiting HTTP. This method 
may be one of the easiest ones to use mainly because the protocol is already allowed 
through many firewalls as part of normal operations. HTTP traffic is considered normal 
because just about every company needs to have Internet access or provide public access 
to resources such as web servers and web applications. 


One tool that may be used to exploit this situation is HTTPTunnel, which uses a client- 
server architecture to facilitate its operation. 

Testing a Firewall and IDS 

With so many techniques and mechanisms at your disposal, you can now test your 
defensive and monitoring capabilities. 

Overview of Testing a Firewall 


The following are the general steps for testing the integrity and capability of a firewall, 
whether it is based on hardware or software: 


1. Footprint the target. 

. Perform port scanning. 

. Perform banner grabbing against open ports. 
. Attempt firewalking. 

. Disable trusted hosts. 

. Perform IP address spoofing. 

Perform source routing. 

. Substitute an IP address for a URL. 


. Perform a fragmentation attack. 
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. Use an anonymizer. 
. Make use of a proxy server to bypass a firewall. 


. Use ICMP tunneling. 


_ 


N 


3. Use ACK tunneling. 


Overview of Testing an IDS 


Much like testing a firewall, there is a general process for testing an IDS. It tends to be 
something like the following: 


. Disable trusted hosts. 


an 


. Attempt an insertion attack. 

. Implement evasion techniques. 
. Perform a DoS. 

. Use code obfuscation. 


. Perform a false-positive generation technique. 
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. Attempt a Unicode attack. 
8. Perform a fragmentation attack. 


It is important to remember that not every attack will work when testing a firewall or IDS, 
but you should still log the results and make note of the way the devices respond. When 
testing is complete, compare and analyze the results to see if you can determine any 
patterns or behavior that may indicate the nature of the environment or vulnerabilities 
present. 


Summary 


In this chapter we looked at firewalls, IDSs, and honeypots as mechanisms used to defend 
a network as well as something to evade as an attacker. You saw that the problem is that 
whereas many attacks are effective at getting information, they can be thwarted by using 
any of the systems we have covered. Today’s networks and environments employ a range 
of defensive and detective measures designed to deal with such attacks. 


Corporations now routinely use many defensive measures, each with its own way of 
putting a stop to attacks. Intrusion detection systems, intrusion prevention systems, 
firewalls, honeypots, and other such systems are potent adversaries and obstacles to your 
activities. Although these devices are formidable, they are not insurmountable, so you 
must learn how they work and then see what you can do to overcome the obstacles or just 
get around them altogether. 


Exam Essentials 


Understand the different types of firewalls. Know that not all firewalls are the same 
and that each operates a little differently. For example, packet filtering firewalls work at 
the network level and are commonly embedded in routers, whereas stateful firewalls are 
devices unto themselves. 


Know the differences between HIDSs and NIDSs. Understand that an HIDS and an 
NIDS are not the same and do not monitor the same type of activity. An NIDS monitors 
traffic on a network but diminishes in effectiveness where a host is concerned. An HIDS 
has diminished capability outside a specific host. 


Understand the role of a honeypot. A honeypot is a tool used to attract an attacker 
for the purpose of research, to act as a decoy, or to gain intelligence as to what types of 
attacks you may be facing and how well your defenses are working. 


Review Questions 


1. An HIDS is used to monitor activity on which of the following? 
A. Network 
B. Application 
C. Log file 
D. Host 
2. Which of the following can be used to identify a firewall? 
A. Search engines 
B. Email 
C. Port scanning 
D. Google hacking 
3. An NIDS is based on technology similar to which of the following? 
A. Packet sniffing 
B. Privilege escalation 
C. Enumeration 
D. Backdoor 
4. Which of the following can be used to evade an IDS? 
A. Packet sniffing 
B. Port scanning 
C. Enumeration 
D. Encryption 
5. Altering a checksum of a packet can be used to do what? 
A. Send an RST. 
B. Send a URG. 
C. Reset a connection. 
D. Evade an NIDS. 
6. Firewalking is done to accomplish which of the following? 
A. Find the configuration of an NIDS. 
B. Find the configuration of an HIDS. 


C. Uncover a honeypot. 


D. Analyze a firewall. 


. Amethod for overwhelming an IDS using packets with incorrect TTL values or flags is 


known as what? 

A. Session splicing 
B. Insertion 

C. Fragmenting 


D. ACK scanning 


. How does a fragmentation attack, which takes a packet, breaks it into fragments, and 


sends only some of the fragments to the target, cause a DoS? 
A. By consuming processor power on the IDS 

B. By overwhelming the IDS with too many fragments 

C. By exhausting memory by caching the fragments 

D. By filling virtual memory with too much data 


. Which of the following uses a database of known attacks? 


A. Signature file 
B. Anomaly 
C. Behavior 
D. Shellcode 


. An anomaly-based NIDS is designed to look for what? 


A. Patterns of known attacks 
B. Deviations from known traffic patterns 
C. Log alterations 


D. False positives 


. Multihomed firewall has a minimum of how many network connections? 


A. Two 
B. Three 
C. Four 
D. Five 


. ADMZ is created with which of the following? 


A. A firewall and a router 


B. A multihomed firewall 
C. Two routers 


D. A multihomed router 


. A firewall is used to separate which of the following? 


A. Networks 
B. Hosts 

C. Permissions 
D. ACL 


. In practice a honeypot will be configured how? 


A. As an unpatched system 
B. As a decoy server 
C. As a duplicate of a real system 


D. As an analysis tool 


. Which ports does SNMP use to function? 


A. 160 and 161 
B. 160 and 162 
C. 389 and 160 
D. 161 and 162 


. HTTP is typically open on which port in a firewall? 


A. 25 
B. 443 
C. 80 
D. 110 


. What is a system used as a chokepoint for traffic? 


A. IDS 
B. DMZ 
C. Bastion host 
D. SNMP host 


. At which layer of the OSI model does a packet-filtering firewall work? 


A. Layer 1 
B. Layer 2 


C. Layer 3 

D. Layer 4 

. What type of firewall analyzes the status of traffic? 
A. Circuit level 

B. Packet filtering 

C. Stateful inspection 

D. NIDS 


‘0. What can be used instead of a URL to evade some firewalls? 


A. IP address 

B. Encryption 

C. Stateful inspection 
D. NIDS 
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What is the cloud? Where is the cloud? Are we in the cloud now? 
These are all questions you’ve probably heard or even asked yourself. The term cloud 
computing is everywhere. 


In the simplest terms, cloud computing means storing and accessing data and programs 
over the Internet instead of locally. The cloud is just a metaphor for a service or storage 
where the exact underlying mechanics aren’t required to be known or just don’t matter. 
Rather, the functionality provided is the important part of the equation. 


The cloud is different than network attached storage or other types of servers—much 
different. Storing content on a home storage device or enterprise storage device is not the 
same as having or utilizing the cloud. In fact, the cloud is much different from other 
storage methods of the past and counts as a new way of delivering services or providing 
storage or simply as a development platform. The cloud is not as simple as some 
companies would have you believe, with one company even naming their technology “My 
Cloud” just to make things more confusing. 


What Is the Cloud? 


While cloud computing is a new term, it is not a new concept and is actually a grown-up 
and more mature version of what used to be known as grid computing. No matter what 
you call it, the cloud is a way of moving services, infrastructure, and platforms into the 
new environment. Ideally, this move makes the growth and management of software and 
other technology easier and more cost effective than before. 


rage The concept of the cloud has been evolving over the last three decades 
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with many different ideas and developments converging to make the cloud what we 
understand it today. Of course, what initially was looked at as a way of pooling 
resources and providing storage has become much more than that over the last 
several years. 





So what is the cloud exactly, and how can we define it in a way that makes sense? In 
general, we can break down the list of characteristics of a cloud computing solution into 
something quite simple and succinct: 


On-Demand Self-Service Users of cloud services have the capability to tweak, 
customize, and configure services as needed to meet their needs both now and in the 
future. 


Broad Network Access Resources can be accessed from any device anywhere with any 
connection. The cloud is designed to be accessed from anywhere. 


Resource Pooling The provider’s computing resources are pooled to serve multiple 
consumers using a multi-tenant model, with different physical and virtual resources 
dynamically assigned and reassigned according to consumer demand. 


Rapid Elasticity Capabilities within the cloud have the ability to be expanded and 
adjusted to add more performance, space, or capability to the system, allowing the user to 
grow as needed without having to worry about the process. In fact, to them it may seem 
like they have unlimited space and resources. 


Measured Service Cloud systems automatically control and optimize resource use by 
leveraging a metering capability at some level of abstraction appropriate to the type of 
service. Resource usage can be monitored, controlled, and reported, providing 
transparency for the provider and consumer. 


i If you were to ask a group of IT people and executives what the cloud is, 
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their definition would probably include much more flowery language and 
descriptions than what are used here. However, by most definitions the points listed 
here tend to describe the vast bulk of cloud deployments with minor differences here 
and there. 





The most common areas where people have encountered cloud technologies are things 
like email and the widespread use of services such as Google Docs, which allows 
collaboration with multiple users across the Internet. The average Joe doesn’t need to 
have a dedicated desktop mail client to store all their email and attachments but instead 
can store everything in the cloud and use a web browser for access. 


Office suites such as Google Apps and Office 365 have also entered the cloud service 
world and are used by numerous consumers and businesses. We should also mention 
that services such as Dropbox and OneDrive are also popular cloud storage options that 
both the consumer and the workplace should be aware of. Microsoft and other companies 
are also experimenting with moving programs to the cloud to make them more affordable 
and more accessible to computer and Internet users. These include technologies such as 
Exchange, Active Directory, SharePoint, and more. 


With the ubiquitous support for cloud technologies by both service providers and the 
consumer, it is no doubt that they will be around a long time. Consumers will continue to 
use the services offered by the cloud, and businesses will seek to move the cost and 
responsibility to a third party in order to simplify this responsibility and lower the 
expense. 


Types of Cloud Solutions 


Calling the cloud “the cloud” simply isn’t accurate because it doesn’t fully describe the 
scope of cloud services. While cloud services all share the ability to provide shared 
resources, shared software, and shared information to reduce an organization’s 
information technology (IT) costs, they also provide the ability to combine services in 
different ways and scale up an almost unlimited amount to increase raw computing 
power without the consumer having to invest in the equipment needed to support the 
setup. 


The first point to consider when discussing the cloud is what form the cloud will take: 
public, private, hybrid, or community: 


e The public cloud is sometimes also called an external cloud and is hosted by a third 
party that has their own personnel and resources located at their own offsite facility. 
Customers can add or remove space and services on demand and only pay for those 
services they use and how much of them they need. 


The problem from a security standpoint with public clouds is that they are owned by a 
third party and any data placed on those systems (although you still own it) is 
controlled by a third party. If the idea of a third party having control of your 
information is an unacceptable risk, then this is not a solution for you. 


e A private cloud is a cloud setup that has been built from the ground up by an 
individual company for internal use only. While this solution offers all the benefits of 
the cloud itself, it also offers the organization full and complete control of their 
information because it is all kept onsite in their own infrastructure. 


e Ahybrid cloud is another potentially useful setup because it combines public and 
private clouds. In this setup a company might store its sensitive data on the private 
cloud while scaling up additional space and capability with the public cloud. 


e Acommunity cloud is another setup that is shared by several parties, but the 
difference here is that the individual parties share common goals, security needs, and 


resources. This setup can make things easier for management purposes and 
requirements will be similar. 


Although each of these models offers benefits, there are also potential snags. One 
potential concern is the time data can take to travel from a remote site compared to the 
time it takes when the data is stored locally. The delay is known as data latency, and it 
may cause problems for time-sensitive operations. 


When looking at the cloud question in terms of security, the private cloud 


setup tends to win the contest. However, the tradeoff in this situation is that a 


private cloud requires a higher investment in hardware, support, and related items. 
On the other hand, going with a public cloud reduces all these costs and expenses but 
the security needs to be evaluated and monitored much more closely. 





Forms of Cloud Services 


So now that you are clear on the different types of deployments that can be made with 
cloud services, let’s look at the various forms of cloud services: 


e Software as a Service (SaaS) is the fastest growing and largest part of the cloud 
services market today and is expected to continue its rapid growth. This form of cloud 
service has become so popular so quickly because many companies are looking to SaaS 
to supplant their current applications and services. The idea of being able to offload 
the management of software to a third party but still be able to leverage the features of 
the software is the allure. For example, a company that chooses to go with a product 
such as Office 365 from Microsoft can integrate with a range of cloud-based services 
as well as more easily update and share documents. Another example is Google’s 
Gmail service, which puts the setup and management of mail servers in the cloud and 
lets the users access their mailbox from anywhere. 


Because of the web delivery model, SaaS eliminates much of the need to install and 
run applications on individual computers; in many cases only browser plugins are 
required. This ease of use also is attractive to corporations looking to reduce their 
support burdens and costs. 


e Platform as a Service (PaaS) is another type of cloud service but is targeted mostly 
toward development purposes. Software developers can use PaaS as a framework upon 
which to develop applications. PaaS makes the development, testing, and deployment 
of applications simple and cost effective. With this technology, enterprise operations, 
or a third-party provider, can manage OSs, virtualization, servers, storage, networking, 
and the PaaS software itself while developers manage the applications. 


e Cloud infrastructure services, known as Infrastructure as a Service (IaaS), are self- 
service models for accessing, monitoring, and managing remote datacenter 


infrastructures, such as computing, storage, networking, and networking services (for 
example, firewalls). 


For something to be considered cloud computing, you need to access your data or your 
programs over the Internet—or at the very least, have that data synchronized with other 
information over the web. In a large business environment, you may know all there is to 
know about what’s on the other side of the connection; as an individual user, you may 
never have any idea what kind of massive data processing is happening on the other end. 


Threats to Cloud Security 


Cloud environments don’t mean fewer problems relating to security; many of the same 
issues from traditionally hosted environments exist in the cloud. Cloud security should be 
treated very seriously, as seriously as it would be in any other situation where you have 
mission-critical services, important data, and business processes that you depend on to 
keep things moving. In order to understand the types of threats that exist in the cloud and 
how they may affect your environment, I have compiled a list of security issues that are 
universally recognized as being the biggest, but not the only, issues facing the cloud and 
cloud environments: 


e A single data breach resulting in a loss of a single record is bad, and a breach resulting 
in the loss of multiple records is worse, but a massive loss of records is catastrophic. 
In 2013, Target Corporation lost at least 110 million credit cards and personal 
information to hackers; this theft is still proving costly to their image and their bottom 
line. In 2015, it was revealed that the Office of Personal Management (OPM) in the 
United States lost 22 million records in a single data breach; included in that number 
were around 2 million records that included biometric data on individuals. Both 
breaches were horrendous and have resulted in costly legal action and other issues. 


Data breaches on the scale of Target and OPM are more than possible in the cloud, 
and so you need to be aware of and manage the weaknesses that may lead to such a 
loss. You should use encryption for both storage and transmission. Also, you can 
employ virtual machines to isolate operations and processes in the cloud. In some 
environments the potential for a loss is so great that private clouds should be used 
instead of commercial solutions. 


e Data loss is another potential danger that must be addressed by adopters of the cloud 
or any technology that stores data. Unlike a data breach, data loss is the process of 
losing data through inadvertent or accidental means. For example, the loss of data due 
to a lack of backup would be data loss. Large-scale data loss is possible, but small-scale 
loss of data is much more likely to occur. 


e Account and service traffic hijacking is another concern with cloud applications and 
services, just as it is with traditional applications. By taking advantage of software 
flaws, buffer overflows, poor passwords, or weak encryption, an intruder can gain 
control over an account and even use phishing, sniffing, and MitM attacks to 


compromise the system. Altered transactions, manipulated data, crashed applications, 
and false information are only some of the possible outcomes of this situation. 


No less of a problem is the very real issue of an account being compromised by an 
intruder eavesdropping or using other means to intercept credentials. Once in 
possession of these credentials, the hacker can take additional actions, including 
planting software, changing configurations, or even using a system as a pivot to dive 
deeper into the application or environment. Depending on the situation, it is entirely 
possible for an intruder to get access to a high-level account and have near limitless 
access to the environment. 


Insecure APIs have caused numerous problems. The same APIs put in place to allow 
third-party developers to plug their applications into cloud services can also allow an 
attacker to dig deeply into a system and perform illegal actions and gain information. 
This problem doesn’t take into account the third-party applications that may have 
their own APIs that may be flawed. 


Denial of service is just as possible with a cloud-based application as it is with 
traditional systems. Though cloud services may be less vulnerable in most cases, they 
are still vulnerable and could be taken down by a determined intruder. Add into this 
situation DDoS-based strikes, and a determined intruder could take down a cloud 
service. 


One problem that occurs with the cloud that doesn’t appear in many other places is 
the potential for different types of financial impact. With cloud services the customer 
may get billed for the extra resources being consumed in the form of traffic. In some 
cases the increased expense may cause a business to shut down rather than pay a huge 
bill associated with an attack. 


Malicious insiders have been the focus of a number of conversations regarding the 
cloud. Since you are no longer hosting your solution onsite, you have to trust that the 
provider of the service has properly vetted and is monitoring their employees. A single 
malicious insider could easily cause problems in the form of lost or stolen data; this 
problem could not only impact the operation of your business but also have an 
incredible impact when the data ends up in the wrong hands. 


Abuse of cloud services brings an interesting type of attack to the table. Thanks to the 
increased and aggregated power that is present in cloud solutions, it is possible to pool 
resources in order to crack passwords and encryption keys. This type of attack has 
already been seen with distributed computing, but with the introduction of the cloud it 
has become much easier to carry out. 


Poor security or lack of due diligence from the service provider is possible and could 
be very damaging to the customer. Lack of monitoring, policy, employee screening, 
maintenance, and the like can be catastrophic. Unpatched software due to poor 
maintenance, poor design, or poor programming alone could easily result in security 
issues and other problems. 


e Multi-tenancy environments are acommon setup for the cloud (unless you happen to 
be building a private cloud). In multi-tenant environments there is an increased 
potential for a data breach or other compromise. With resources shared among 
tenants within the cloud, there could be a situation where another tenant is privy to 
your data either through malicious means or accidentally. 


e Remember, unless you are in an environment that you completely own such as a 
private cloud, you are in a shared environment. In any shared environment a lapse in 
security could lead to an exposure, and thus you should take care to ensure that end- 
to-end protection exists. 


The threats listed here are not the only threats in the cloud; they just happen to be some 
of the bigger ones. Many of the threats that exist in the cloud are the same or nearly the 
same as those in traditional, non-cloud deployments. However, that doesn’t mean 
everything is the same across the board, as we will examine in this chapter. 


Cloud Computing Attacks 


In the world of cloud computing, various attacks can be employed against a target; many 
of them are variations or are the same as those you have already seen, but there are some 
new faces. Many of the attacks we will explore here can be executed against any of the 
cloud service models mentioned earlier without any variation. 


Session Riding (aka Cross-Site Request Forgery) 


This attack can be potentially brought to bear against environments that have a web 
application present. Let’s examine how this type of attack functions to compromise a 
system. 


CSRF is an attack designed to entice a victim into submitting a request, which is 
malicious in nature, to perform some task as the user. Since the request is inadvertently 
submitted by the user, the request runs with the privileges and context of the user, 
meaning that depending on what access they have, the request could cause serious harm. 
Making this attack even more effective is that most of the applications that accept this 
type of attack keep track of information about the client. Armed with this information and 
not knowing that the user was enticed into executing the request, the application will 
have no way to determine if the request is malicious; it will assume it is legitimate since it 
appears to originate from the same place. 


So what harm can the attack accomplish? Typically the attacking party will attempt to 
alter information on the server so as to make it easier to compromise or come back later. 
Attackers would not benefit from using a CSRF to retrieve information because the 
request is executed by the victim and the responses would return to them. 


Another variation and more advanced version of this attack is a stored CSRF attack. In 
this type of attack the forged request is stored on the server. An attacker can store the 
request on a site by finding a site that accepts HTML input and submitting a request as an 


<img> tag or other tag and in some cases even as a form of stored XSS attack. 


Let’s take a closer look at how the attack works in practice. Keep in mind that this form of 
attack has numerous options and variations with which to deploy itself. The form we will 
use is simple and will take the following form: 


1. Building an exploit URL or script 
2. Tricking the victim into executing the action 
3. Executing a GET command 


If the exploited application has been developed to use GET requests to transfer 
parameters and execute actions, the response might take this form: 


GET http://<address>?<action> HTTP/1.1 


An attacker seeing that this type of attack works could then craft an attack that does 
something more malicious. With a little effort the attacker could simply alter the action 
portion of the request to perform a more aggressive and bolder action, such as 
transferring money from the victim’s account to the attacker’s account. 


The key to making this attack successful for the attacking party is to find a way to get the 
victim to execute the request when they are logged in to the account. 


rg es CSRF, or session riding, is not exclusive to cloud environments; it can 
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occur in environments where non-cloud web applications exist. Nothing delineates 
the two environments; the same technologies can exist in both situations, which 
consist of web servers and applications hosted on top of them. 





Side Channel Attacks 


This type of attack is unique to the cloud and potentially very devastating, but it requires 
a lot of skill and a measure of luck. This form of attack attempts to breach the 
confidentiality of a victim indirectly by exploiting the fact that they are using shared 
resources in the cloud. 


In order to execute this attack successfully, the attacker must have a few things in place: 


e Avirtual machine placed on the same physical location as the victim. By definition 
this is very tough to do because the cloud is designed to hide the details of the physical 
side of things from the customer. However, using tools such as traceroute and DNS 
queries, it is possible to locate a target system with around 50 percent accuracy. 


e Once the VM is placed on the same server as the VMs of the victim, the attacking party 
can commence their actions. 


e So placed, the attacker can exploit the fact that they and their target are on the same 


server sharing resources, including memory, processor, cache, and the network itself. 
In this situation, the attacker can use scripts and applications to determine if sensitive 
information is somewhere within reach of being intercepted. 


Fortunately, side channel attacks are very difficult to execute and have very few cases of 
being successful in the wild. 


rate Research has been published by the University of North Carolina at 
A JTE 


Chapel Hill on the mechanics and effects of side channel attacks. They have 
published several papers on how the attack works, how they conducted their 
research, and many more potential scenarios than are possible to mention here. 





Signature Wrapping Attacks 


Another type of attack is not exclusive to a cloud environment but is nonetheless a 
dangerous method of compromising the security of a web application. Basically, the 
signature wrapping attack relies on the exploitation of a technique used in web services. 


In the Simple Object Access Protocol (SOAP) used by web services, requests and 
responses can be signed using an XML signature. The messages contain a security header 
with an included signature element that references how the message has been signed. In 
practice, the messages are typically in parts and are referenced by an ID, and so to validate 
the signature the recipient must find the element in the request that has the 
corresponding ID. An XML signature wrapping attack essentially exploits the fact that the 
signature element does not convey any information as to where the referenced 
element(s) is (are) in the document tree. 


An XML signature wrapping attack would work as follows. A malicious user could take a 
valid request, copy the SOAP body, and insert it as part of a header in the request. The 
malicious user would then freely alter the SOAP body but preserve the same ID. The 
message recipient must search for the reference URI as part of the signature validation 
process and would hit the copied SOAP body element first. This would verify correctly 
since it has not been changed. Finally, the recipient would check to see if the ID of the 
SOAP body was actually referenced in the signature. 


The result of this attack is that an attacker could alter a message without invalidating it. 
This means the system or application would accept the message as correct even though it 
had been altered. 


vate So what is SOAP? SOAP was designed to allow web services and 
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applications to communicate regardless of their operating system. Specifically, it 
allows the use of HTTP and XML over the various protocols. 


The benefit of protocols such as HTTP and XML is that they are universal and 
provide support across all major operating systems and devices. With the addition of 
SOAP, an application on one computer can talk to an application on another 
computer and understand how to encode the HTTP headers and XML so the two can 
pass reliable information back and forth. One thing to keep in mind with SOAP, 
however, is that it is frequently paired with HTTP, but it is not in any way bound to 
this protocol. 


In fact, SOAP specifically defines the XML format that applications use to 
communicate over the web. It is due to protocols such as SOAP that the dissimilar 
platforms across the web can communicate and establish a standard. 


Far more information on SOAP is available than is described here, but it is not 
necessary for penetration testers to know it at this level. 





Other Types of Attacks against the Cloud 


What I have attempted to document in this chapter on cloud technologies are the attacks 
that are unique or have changed in respect to the cloud. There are other attacks to be 
sure, but we have covered all of them already in other chapters, so we will not cover them 
again here to keep things simple. 


The attacks that you can view in other chapters that are also applicable to the cloud 
include the following: 


e Service hijacking using network sniffing 
e Session hijacking using XSS attacks 

e Domain Name System (DNS) attacks 

e SQL injection attacks 


Cryptanalysis attacks 
e Denial-of-service (DoS) and Distributed DoS attacks 


These are not the only types of attacks that can be deployed by an attacker against a cloud 
service. Attacks such as buffer overflows, social engineering, application attacks, input 
validation, MitM, session hijacking, and others also pose a threat depending on the 
conditions and what is actually present in a specific environment. 


Controls for Cloud Security 


When working with the cloud, you can deploy many controls in response to the various 
threats to a cloud environment: 


e Security design and architecture are huge keys to the success or failure of your cloud 
solution. Firewalls, virtual machines, storage encryption, IDS, Transport layer 
encryption, policies, and many other tools can be employed. The even bigger 
consideration to ensuring that security works at the optimum level is through design, 
specifically by addressing security at the beginning of the process rather than later on. 


e Identity and access management are critical for any secure application and just as 
much so for cloud applications. A comprehensive solution consisting of 
authentication, authorization, and the access control that comes with it is essential to 
the protection of critical resources. Furthermore, cloud service providers are being 
tasked with providing even stronger solutions in the form of multi-factor 
authentication, which offers increased levels of protection and can go a long way 
toward minimizing risk. 


e Governance is an oft-mentioned but not always clearly understood aspect of 
technology and systems that we need to set straight. In the context of the cloud, 
governance ensures that the policies, procedures, standards, and other related items 
are deployed and enforced to ensure proper functioning and support. 


e Risk management is vital, as are all the risk assessments and vulnerability 
assessments that go along with it. All organizations that seek to place their 
information, services, or applications within the cloud need to ensure that they closely 
examine and assess the level of risk they are taking on and if they can or need to do 
more to lower it. In today’s environment, evaluating risk in relation to PII or PHI is 
not only financially important but also legally important. 


e Compliance is another key area that must be observed and adhered to because it 
represents your legal responsibilities. Compliance is based on industry, locations, type 
of data, and other factors. Being out of compliance is a big problem with potential 
fines, civil actions, and other actions waiting in the wings to penalize you for failure. 


e Availability comes to the consideration of a solution’s usability and uptime; most 
companies just look at the number of 9s in the SLA provided by their CSP. But they 
often fail to consider about what happens when any of the following occurs: 


e Temporary loss of access 
e Outage—equipment/network failure 
e Permanent loss of data 


Natural disaster 


e Denial of service 


e Business continuity and Disaster Recovery 


Testing Security in the Cloud 


So how do you test for security in the cloud? Many options are available in both the 
manual and automated tools you have used with web applications, but there are other 
options as well. 


The tools listed here are discussed at SearchSecurity.com and are representative of 
normal tools for cloud testing: 


SOASTA CloudTest This suite can enable four types of testing on a single web platform: 
mobile functional and performance testing and web-based functional and performance 
testing. It can simulate millions of geographically dispersed concurrent users visiting a 
website to test the application under huge loads. 


LoadStorm LoadStorm is a load-testing tool for web and mobile applications and is easy 
to use and cost effective. It is ideal for checking performance under excessive traffic or 
usage and is highly scalable; it can simulate as many virtual users as required to find the 
breaking point of a website or app. Various load-testing scenarios are available, which are 
also customizable. 


BlazeMeter BlazeMeter is used for end-to-end performance and load testing of mobile 
apps, websites, and APIs. It is JMeter compatible and can simulate up to 1 million users. 
It facilitates realistic load tests and performance monitoring combined with real-time 
reporting. 


Nexpose Nexpose is a widely used vulnerability scanner that can detect vulnerabilities, 
misconfigurations, and missing patches in a range of devices, firewalls, virtualized 
systems, cloud infrastructure, and the like. You can use it to detect threats such as 
viruses, malware, backdoors, and web services linking to malicious content. For sectors 
like healthcare and banking, it can also be used to perform compliance auditing. It 
generates scan reports and remediation recommendations in flexible formats, including 
sending targeted emails. 


AppThwack AppThwack is a cloud-based simulator for testing Android, iOS, and web 
apps on actual devices. It is compatible with popular automation platforms like 
Robotium, Calabash, UI Automation, and several others. If you wish to test through 
clients other than the official site, there is a REST API that allows that. Other key features 
include multi-platform support, customizable testing, and detailed test reports. 


Jenkins Dev@Cloud Dev@Cloud facilitates development, continuous deployment, and 
integration on the cloud. It allows development in many languages and deployment to 
any number of services. It provides a wide array of mobile tools for development and 
allows you to connect securely to existing systems via the cloud. It brings in benefits of 
third-party systems like Google App Engine, Cloud Foundry, and AWS Elastic Beanstalk. 


Xamarin Test Cloud Xamarin Test Cloud is a UI acceptance-testing tool for mobile 
apps. It allows writing tests in C# using the NUnit testing library through the UITest 
framework or in Ruby through the Calabash framework. The tool runs the test on over a 


thousand physical devices and displays full-resolution screen shots of each step, including 
relevant data like CPU and memory usage and test time. It can be integrated into 
automated builds for continuous integration. 


Summary 


The term cloud computing is everywhere, and the technology is deployed everywhere 
from the home market to the business place. Because it is such a common technology, it 
can and will be integrated into the environments you will be penetration testing. 
Therefore, you need to know how the cloud is positioned. 


In the simplest terms, cloud computing means storing and accessing data and programs 
over the Internet instead of your computer’s hard drive. The cloud is just a metaphor for a 
service or storage where the exact underlying mechanics aren’t required to be known or 
just don’t matter. Rather, the functionality provided is the important part of the equation. 


The cloud is different than network attached storage or any other type of server. Storing 
content on a home storage device or enterprise storage device is not the same as having or 
utilizing the cloud; the customer never knows where the content is. The cloud is much 
different than other storage methods of the past and counts as a new way of delivering 
services, providing storage or simply a development platform. 


Fortunately, cloud computing has been around for some time now, and the applications 
hosted in that environment are both easy to test and use the same tools that we use to 
test web applications and other environments. 


Exam Essentials 


Understand the different types of cloud platforms. Understand that not all cloud 
platforms are the same, and each offers something different than the others. 


Know what types of security are available in the cloud. While the cloud is 
different in many respects and similar to other environments, security has to be carefully 
considered. 


Understand the threats that face cloud environments. Many of the threats that 
face cloud environments also face traditional environments. Threats such as man in the 
middle and others can cause the same problems as they can in traditional situations. 


Review Questions 


I. 


SaaS is a cloud hosting environment that offers what? 
A. Development options 

B. Testing options 

C. Software hosting 


D. Improved security 


. Which of the following can be used to protect data stored in the cloud? 


A. SSL 

B. Drive encryption 

C. Transport encryption 
D. Harvesting 


. SOAP is used to perform what function? 


A. Transport data 

B. Enable communication between applications 
C. Encrypt information 

D. Wrap data 


. Which attack alters data in transit within the cloud? 


A. Packet sniffing 
B. Port scanning 
C. MitM 

D. Encryption 


. Altering a checksum of a packet can be used to do what? 


A. Send an rst 

B. Send a urc 

C. Reset a connection 
D. Evade an NIDS 


. Cloud technologies are used to accomplish which of the following? 


A. Increase management options 


B. Offload operations onto a third party 


C. Transfer legal responsibility of data to a third party 
D. Cut costs 


. Acloud environment can be in which of the following configurations except? 


A. IaaS 
B. PaaS 
C. SaaS 
D. LaaS 


. What type of cloud service would provide email hosting and associated security 


services? 
A. PaaS 
B. SaaS 
C. IaaS 
D. SSaS 


. Who has legal responsibility for data hosted in the cloud? 


A. The Cloud Service Provider 
B. The IT department of the client 
C. The client 


D. The consumer 


. Why wouldn’t someone create a private cloud? 


A. To reduce costs 
B. To offload technical support 
C. To increase availability 


D. To maintain universal access 


. There are how many different types of cloud hosting environments? 


A. Two 
B. Three 
C. Four 
D. Five 


. Which of the following would be hosted as SaaS? 


A. Email 
B. Active Directory 


C. Applications 


D. Firewalls 


. Acloud-based firewall is used to separate which of the following? 


A. Networks 
B. Hosts 

C. Permissions 
D. ACL 


. An application would be developed on what type of cloud service? 


A. BaaS 
B. SaaS 
C. IaaS 
D. PaaS 


. Which of the following issues would be a good reason for moving to a cloud based 


environment? 

A. Reduced costs 

B. Improved performance 
C. Easier forensics 


D. Increased redundancy 


. HTTPS is typically open on which port in a cloud based firewall? 


A. 25 
B. 443 
C. 80 
D. 110 


. What system is used as a choke point for traffic and could be offered through IaaS? 


A. IDS 
B. DMZ 
C. Bastion host 
D. SNMP host 


. At which layer of the OSI model would you expect a cloud based solution to operate 


at? 


A. Layer 1 


B. Layer 2 
C. Layer 3 
D. Layer 4 


. What type of firewall analyzes the status of traffic and would be part of a IaaS 
solution? 


A. Circuit level 

B. Packet filtering 

C. Stateful inspection 
D. NIDS 


‘0. What can be used instead of a URL to evade some firewalls used to protect a cloud 


based web application? 
A. IP address 

B. Encryption 

C. Stateful inspection 
D. NIDS 
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à Working with all the technical and administrative parts of security, 
you may easily overlook the physical component. If you get too immersed in the technical 
details and other aspects, it is entirely possible that you may miss something that can be 
physically done to a piece of hardware or equipment, such as theft or vandalism. As an 
ethical hacker or security administrator, you need to come to grips with the fact that not 
all of what you do will be focused only on the technical aspects, so you must know how to 
protect your assets from physical threats. 


Those who perform malicious actions are well aware that although technology and 
defenses have gotten better, the physical side is overlooked far too often. In many cases, if 
an attacker does not have a clear or easy way of using technology to breach a target, they 
may move over to a physical attack to gain information or access. Techniques such as 
dumpster diving and tailgating, among others, have proven very effective and popular. In 
addition, weaknesses in the security of a facility can allow a malicious or unauthorized 
party to gain access to a portion of an office or location that they should not otherwise be 
able to access. 


Attackers of all types are known to put locations under surveillance to look for these 
weaknesses. These stakeouts allow an attacker to see traffic patterns and other activity in 
and out of a location as well as the personnel, potentially giving them the ability to target 
individuals or see when it may be an ideal time to breach a facility. 


In this chapter we will cover many aspects of physical security, including the ways that an 
attacker can gain control of an environment through nontechnical means. 


Introducing Physical Security 


Physical security defenses, in many cases, are the primary protective boundary for 
personnel assets in the real world. Physical security involves the protection of such assets 
as personnel, hardware, applications, data, and facilities from fire, natural disasters, 
robbery, theft, and insider threats. 


The problem with physical security is that it can be easily overlooked in favor of the more 
publicized technical issues. Companies do so at their own peril, however, since 
nontechnical attacks can be carried out with little or no technical knowledge. 


Simple Controls 


Various controls can be used to protect and preserve the physical security of an 
organization. You have already encountered several throughout this book. In many cases, 
just the visible presence of controls is enough to stop an attack. 


One of the most basic controls that can protect physical interaction with a device, system, 
or facility is the use of passwords. Passwords can protect a system from being physically 
accessed or from being used to access a network. 


Passwords and Physical Security 


Passwords are perhaps one of the best primary lines of defense for an environment. 
Although not commonly thought of as a protective measure for physical intrusions, they 
do indeed fulfill this purpose. However, the downside is that unless passwords are 
carefully and thoughtfully implemented they tend to be somewhat weak, offering 
protection against only the casual intruder. Organizations have learned, as you saw in our 
system hacking exploration, that passwords can be easily circumvented and must be 
managed in order to avoid problems. 


Working with Passwords 


Experience has shown that users of systems tend to do the following: 


e Ninety percent of respondents reported having passwords that were dictionary 
words or proper names. 


e Forty-seven percent used their own name, the name of a spouse, or a pet’s name 
as their password. 


e Only 9 percent actually remembered to use cryptographically strong passwords. 





Companies and organizations of all types have had to enforce strong password policies 
and management guidelines in order to thwart some of the more common and dangerous 
attacks. As you saw earlier in this book, passwords should always be complex and well 
managed; components of a good password include the following: 


e Allow no personal information in passwords. 


e Avoid passwords that are less than 8 characters. The standard nowadays is moving 
toward 12 characters and longer. 


e Require regular password change intervals—for example, every 90 days a password 
will be changed. 


e Enforce complex passwords that include upper- and lowercase letters as well as 
numbers and characters. 


e Limit logon attempts to a specific number before an account is locked. 


rete Something increasingly observed in the real world is the replacing or 
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supplementing of traditional passwords with additional security measures, including 
tokens and smart cards. The idea is that the addition of these devices to existing 
password systems will markedly improve the security of systems and environments 
overall. The problem is that such an approach carries a large cost up front in terms of 
upgrades to infrastructure and equipment. However, do expect these devices and 
systems to become more commonplace. 





Screensavers and Locked Screens 


In the past, one of the common ways to gain access to a system was to simply look around 
for an unattended system. In many cases, the system would be left logged in and 
unlocked by a user who was only going to step away “for a moment” without realizing that 
a moment was enough for an attacker to cause mischief or worse. 


To thwart intruders from attempting to use an unattended system, you can use a 
password-protected screensaver or a locked console. The older of these two mechanisms 
is the password-protected screensaver. Its popularity comes from the fact that it is easy to 
implement and will stop many a casual intruder. The concept is simple: When a user 
leaves a system idle for too long, the screensaver starts and, once it does, only a password 
can deactivate it. In most cases, someone walking by wiggling a mouse or tapping the 
keyboard will be prompted for a password, usually providing a deterrent sufficient to stop 
any further attempts. 


Working alongside or instead of screensavers is the newer and more preferred lock 
screen. This screen, when available on a given operating system, will actively lock the 
desktop until a password and username are entered into the system. The benefit of this 
mechanism over screensaver mechanisms is that it provides a much more secure way of 
locking a computer than a simple screensaver, which provides minimal protection. In a 
Windows environment, pressing Ctrl+Alt+Del will lock the screen manually, while a 
system administrator can deploy a policy that will lock the system automatically after a 
defined period. It is important, however, to make sure that users understand that locking 
the screen automatically does not absolve them of any responsibility for making sure they 
log out properly. 


rg i In some environments, smart cards are issued in addition to standard 
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usernames and passwords. The smart card must be inserted into a reader on the 
system prior to logging in to the desktop. 





Another mechanism for protecting or defending a system is the use of warning banners. 
When in place, a warning banner provides a high-profile message stating that a user of a 
system will be held accountable for their actions as well as consent to other things such 
as monitoring. In addition, warning banners establish what is and is not acceptable on a 
system and set the stage legally if any sort of action needs to be taken against a user, such 
as termination of employment. 


The following is an example of a warning banner: 
*“*WARNING**WARNING**WARNING** 


This is a (Agency) computer system. (Agency) computer systems are provided for the 
processing of Official U.S. Government information only. All data contained on 
(Agency) computer systems is owned by the (Agency) and may be monitored, 
intercepted, recorded, read, copied, or captured in any manner and disclosed in any 
manner, by authorized personnel. THERE IS NO RIGHT OF PRIVACY IN THIS 
SYSTEM. System personnel may give to law enforcement officials any potential 
evidence of crime found on (Agency) computer systems. USE OF THIS SYSTEM BY 
ANY USER, AUTHORIZED OR UNAUTHORIZED, CONSTITUTES CONSENT TO THIS 
MONITORING, INTERCEPTION, RECORDING, READING, COPYING, OR 
CAPTURING and DISCLOSURE. 


**WARNING**WARNING**WARNING** 


Although different companies and organizations will use different warning banners, the 
intent is generally the same: to inform users that they are being monitored. 


Dealing with Mobile Device Issues 


An additional issue that must be considered in today’s environment more than ever is the 
physical theft of devices and equipment. With the proliferation of ever more powerful and 
compact devices—including mobile devices, laptops, cell phones, and even hard drives— 
providing some sort of protection has become essential. Because many devices today are 
easily portable, theft has become much easier. Gone are the days when an attacker would 
have to carry a large device or piece of equipment out of a building. Now they can quickly 
and easily take it from a desktop or steal it from a user outside the building. 


Encryption 


Mobile devices are increasingly being required to have encryption measures in place. 
Internal storage and MicroSD cards are required in many organizations to be encrypted 


on all mobile devices. Many have taken this step to avoid the disclosure of private or 
embarrassing loss of data if the device falls into the wrong hands or is stolen. It is alsoa 
legal requirement in many cases to ensure this protection is in place. 


In addition, modern mobile OSs such as Android 6.0 Marshmallow have gone one step 
further by making encryption mandatory. While Android 5.0 tried to make this 
mandatory, the hardware at the time was not adequate to provide decent performance 
when encryption was enabled. Now with more powerful hardware available, the feature 
must be enabled unless otherwise unable to do so. This means that by default storage on 
these devices will be encrypted. 


Data Storage Security 


One of the problem areas to emerge over the past few years is the physically small but 
large-storage-capacity hard drives. Specifically, the ones we are concerned about here are 
the external hard drives that use USB or FireWire to interface with a system. The 
proliferation of these devices is a result of their ability to move large amounts of data in 
an easy-to-carry format. This is also the problem with the devices: They carry a 
tremendous amount of information and can be easily transported. The average external 
drive is typically no bigger than a pack of playing cards. USB devices in the form of flash 
drives present an even more interesting and alarming problem with their small form 
factor and ability to carry large volumes of information. This format allows for the easy 
upload of information such as malware, which it has been used for in many cybercrimes. 


D Real World Scenario 
Problems with USB 


External USB hard drives have been lost or stolen on numerous occasions, 
compromising a company’s security in the process. In some cases, drives that were 
bought with the intention to serve as a backup eventually became the storage area for 


the sole copy of data. Because of the loss of such backups, many companies have had 
to rebuild or recover data, which resulted in big financial losses as well as lost time 
and productivity. 


For security reasons alone, many organizations such as the U.S. Department of 
Defense have banned the use of these devices, making it a punishable offense to have 
them in some facilities. 





Securing a portable hard drive or any storage device can be made easier through the 
application of technology and proper procedures. One of the most efficient ways to 
protect the confidentiality and integrity of information on these devices is encryption. 
Applying encryption across a whole volume or drive provides robust protection against 
data falling into the wrong hands. With the increasingly widespread availability of full 


drive encryption, it is worthwhile for every company or organization to evaluate the need 
and benefits of implementing this type of protection. Although full drive encryption will 
not prevent a drive from being physically stolen, it will go a long way toward preventing 
the thieves from accessing the information easily. 


D Real World Scenario 
Legal Issues with Data 


Encryption may be mandated by law. For example, some U.S. agencies are legally 
required to encrypt the hard drives that are present in laptops in case the device is 
lost or stolen. In 2006 the U.S. Department of Veterans Affairs (VA) lost a laptop that 
resulted in the compromise of 26.5 million patient records. The fallout from this 
incident was financial issues due to identity theft for many of the affected patients as 
well as a $20 million settlement and credit-monitoring services for the victims. 





Currently there are numerous options for deploying drive encryption. Among the leading 
solutions are these: 


e PGP 

e Microsoft BitLocker 

e VeraCrypt 

e WinMagic 

e Linux Unified Key Setup (LUKS) 


Pros and Cons of Drive Encryption 


Drive encryption is becoming an increasingly common option in all sorts of devices, 
from laptops and mobile devices to the drives in some printers. Encryption at this 
level is often required for legal as well as security reasons, but in many cases you 
need to consider performance impacts. 


There is always a price to pay to get something in return, and encryption is no 
different. Due to the complexity of the process and the large amounts of data 
involved, the penalty in system performance may be noticeable. This becomes a 
bigger concern with mobile systems where performance is at a premium and the 
need for encryption is higher. 


As a professional, you will have to choose which is more important to you: 
performance or security. Performance may suffer, but the need for data security may 
be of higher importance as well as legally required. 





When talking about hard drives, we need to cover flash drives as well. Flash drives have 


proven to be both a blessing and a curse because they allow for the carrying of large 
amounts of data, but at the same time they are small and easily lost. To thwart this 
problem, companies need to consider encryption. Unfortunately, many of the 
commercially available drives do not offer encryption services, and the ones that do are 
relatively expensive by comparison. However, you must weigh the cost against how 
dangerous and problematic it would be if one of these devices was lost and fell into the 
wrong hands. 


() Real World Scenario 


The Perils of USB In mid-2015 a new danger was added to the issue of plugging in 
unknown or found hard drives, hardware destruction. 


A researcher from Russia going by the name of Dark Purple created a USB device that 
can permanently destroy computer hardware. The device plugs into a USB port and 
will destroy the hardware on the computer, causing it to catch on fire in some cases. 
The device is able to do this by virtue of the fact that it creates feedback of -220 volts 
which is by far enough to destroy a computer. 





Both portable hard drives and flash drives also suffer from another issue because of their 
size and the amount of data they can carry. These devices, especially flash drives, are 
extremely portable and easy to hide, so they represent a huge security risk. It is easy for 
an attacker to carry a flash drive into an organization and plug it in to steal information or 
to execute a piece of malware. To prevent this in your organization, you should restrict 
the use of flash drives and portable hard drives as well as consider encryption and usage 
policies to control or bar their use. 


In addition to encryption for hard drives and mobile storage, consider how to thwart 
actions such as dumpster diving for discarded media. Companies generate a tremendous 
amount of information on CDs, DVDs, and other formats, including the occasional floppy 
disk (though rare). Develop procedures for the storage, handling, and proper destruction 
of these materials. In most cases, shredding or similar destructive methods can be used 
prior to disposal in order to keep information out of thieves’ hands. Management should 
also dictate how each of these approved forms of storage can be handled and destroyed. 


Some of the methods used for sanitation are as follows: 


Drive Wiping Drive wiping is the act of overwriting all information on the drive. As an 
example, DoD.5200.28-STD specifies overwriting the drive with a special digital pattern 
through seven passes. Drive wiping allows the drive to be reused. 


Zeroization This process is usually associated with cryptographic processes. The term 
was originally used with mechanical cryptographic devices. These devices would be reset 
to o to prevent anyone from recovering the key. In the electronic realm, zeroization 


involves overwriting the data with zeroes. Zeroization is defined as a standard in ANSI 
X9.17. 


Degaussing This process is used to permanently destroy the contents of the hard drive 
or magnetic media. Degaussing works by means of a powerful magnet that uses its field 
strength to penetrate the media and reverse the polarity of the magnetic particles on the 
tape or hard disk platters. After media has been degaussed, it cannot be reused. The only 
method more secure than degaussing is physical destruction. Figure 19.1 shows an 
example of a drive degausser. 
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Figure 19.1 A drive degausser 


In some cases the options we’ve listed here may not be something you can use because 
the media may contain information that requires the media’s physical destruction. This is 
even true in the case of hard drives, where the physical destruction of the device may be 
required, up to and including melting down the device. 


D Real World Scenario 
The Problems with Solid State Drives 


Over the last several years traditional hard drives (the ones with spinning disks 
inside) have been increasingly replaced in favor of solid state drives (SSDs). These 
drives offer increased speed, better performance, lower power usage, and other 
benefits, but they cannot be wiped the same way. The sanitation methods that are 
currently used to wipe, overwrite, or zeroize traditional hard drives don’t work on 
SSD mechanisms. 


In theory, some of the methods used for traditional drives should work, but they tend 
to be questionable. For example, overwriting a drive with ones and zeroes a couple of 
times sounds like a good way to eliminate remnants, but even if everything is 
overwritten there are still chips in the drive that could hold data. Some vendors have 
routines on their drives that are supposed to wipe the drives, but these routines are 
frequently implemented incorrectly. Yet other drives offer features to secure the 
drive by discarding encryption keys, but this isn’t always a complete elimination. 
Finally, none of the current methods for wiping drives can claim to be totally 
effective for sanitizing SSD devices. 


If you have these devices in your environment, you may have to resort to shredding, 
smashing, melting, or grinding up the drive to ensure the sensitive data on it does 
not fall into the wrong hands. 





Securing the Physical Area 


When looking at the overall security stance of an organization, you must also consider the 
facility itself. Someone breaching security and getting into the facility can easily steal 
equipment or data and possibly even perform vandalism or sabotage. In the physical 
world, the first type of controls that someone wishing to cause harm is likely to encounter 
are those that line the perimeter of an organization. When performing an assessment of 
your organization, pay attention to those structures and controls that extend in and 
around your organization’s assets or facilities. Every control or structure you observe 
should provide protection in the form of either delaying or deterring an attack, both with 
the ultimate goal of stopping unauthorized access; the controls should also complement 
one another. Although it is possible that a determined attacker will successfully bypass 
the countermeasures in the first layer, additional layers working with and supporting the 
perimeter defenses should provide valuable detection and deterrent functions. 


rat Don’t forget that security issues do not have to be manmade, malicious, or 
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accidental; they can take other forms, namely in the form of Mother Nature. Rain, 
floods, earthquakes, mudslides, fires, and other events could also impact your 
environment. Problems that may emerge only during a rainy spell are probably not 
going to make an appearance when you evaluate a location in good weather. 





It is also important to note that during the construction of new facilities, the security 
professional should get involved early to advise on what measures can be implemented 
during this phase. However, it is more realistic to assume that the security professional 
will arrive on the scene long after construction of facilities has been completed. In such 
cases, the security professional will have to conduct a thorough site survey with the goal 
of assessing the current protection offered. If you are tasked with performing a site 
survey, do not overlook the fact that natural geographic features can provide protection as 
well as the potential to hide individuals with malicious intent from detection. When a site 
survey of an existing facility is undertaken, consider items such as natural boundaries at 
the location and fences or walls around the site. Common physical area controls placed at 
the perimeter of the facility can include many types of barriers that will physically and 
psychologically deter intruders. These include: 


e Fences 
e Gates 
e Doors and mantraps 
Locks 


e Walls, ceilings, and floors 


e Windows 


Fences 


Fences are one of the physical boundaries that provide the most visible and imposing 
deterrent. Depending on the construction, placement, and type of fence, those deterred by 
this countermeasure may be only the casual intruder or a more determined individual. 
Because fences vary in construction, height, and even color, they can also provide a 
psychological deterrent, For example, consider an 8-foot iron fence with thick bars 
painted flat black—such a barrier can definitely represent a psychological deterrent. 
Ideally, a fence should limit how easy it is for an intruder to access a facility as well as 
provide a psychological barrier. 


Depending on the company or organization involved, the goal of erecting a fence may vary 
from stopping casual intruders to providing a formidable barrier to entry. Fences work 
well at preventing unauthorized individuals from gaining access to specific areas but also 
force individuals who have or want access to move to specific choke points to enter the 


facility. When considering the type of fence to use, you should determine what the 
organization will need to do to satisfy the goals of the security plan. Fences should be 8 
feet or higher to discourage determined intruders. 


rat Some fences are designed so that the top portion of the fence is curved 
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inward or outward, which is made that way for a reason. If the top of a fence is bent 
inward, it is meant to keep people in. But if the top of the fence is curved outward, it 
is focused on keeping intruders out. 





Gates 


Fences by themselves are an effective barrier, but they must exist in concert with other 
security measures and structures. In the case of fences, a gate represents the physical 
manifestation of the concept of a choke point, that is, a point where all traffic must enter 
or exit the facility. Much like fences, all gates are not created equal, and selecting the 
wrong one will not offer proper security. In fact, choosing the incorrect gate can even 
detract from what would otherwise be a decent security measure. Also consider the fact 
that the best fence available can have its usefulness severely degraded if the combination 
of fence and gate is poor. UL Standard 325 details the requirement for gates. 


Doors and Mantraps 


Except for the majority of exterior doors, most doors that an individual will encounter on 
a daily basis are neither designed nor placed with security in mind. In many cases, an 
attacker would be able to easily kick through or push through a door to get at what’s on 
the other side, be it a server room or some other location. 


Doors should be designed and placed with security in mind. Steel or solid-core doors are 
not easily kicked in or compromised. As a pentester, always assess the current physical 
environment in locations such as server rooms and other vital areas to ensure that strong 
doors and locks are being used to prevent intrusions from occurring. 


Doors come in many configurations, including these: 
e Industrial doors 
e Vehicle access doors 
e Bulletproof doors 
e Vault doors 


Is just having a well-selected door the end of the problem? Absolutely not; you must also 
consider the frame that the door is attached to. A good door connected to a poorly 
designed or constructed frame can be the Achilles heel of an otherwise good security 
mechanism. During a security review, be sure to examine not only the doors in place but 


also the hardware used to attach the door to the frame and the frame itself. Consider the 
fact that something as simple as incorrectly attaching the hinges to a door and frame can 
make it easy for an intruder with a screwdriver to break in. 


In addition to doors, mantraps provide another valuable form of security. Mantraps 
replace normal doors with a phone booth-sized object with a door on either side and only 
enough space to hold one occupant. When an individual enters the device and the door 
closes, they are required to enter a code or pass visual screening via a camera. Only once 
they have been approved are they allowed to enter the secure area through the other door. 
In the event that an occupant is denied entry, they are either allowed to exit through the 
door they entered or are locked in until security personnel can retrieve them. The 
intention of the device is not only to provide security to the environment but also to 
prevent tailgating and other forms of access. Figure 19.2 shows a mantrap. 


- m M — — — ———— 
N a == x J vE > ENTA F DE 
~~ Cn sa egi k 
a, 
~ 


D 


D 





Figure 19.2 A mantrap installed in a lobby 


P Mantraps in some environments are also known as portals. Some of these 
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devices include advanced biometric devices, such as retina scanners and handprint 
scanners, as well as other features. 





Locks 


Locks come in many types, sizes, and shapes. They are an effective means of physical 
access control. Locks are by far the most widely implemented security control due largely 
to the wide range of options available as well as the low cost of the devices. 


Lock types include: 
e Mechanical (warded and pin-and-tumbler) 
e Cipher locks (smart and programmable) 


Warded locks are the simplest form of mechanical lock. The design of mechanical locks 
uses a Series of wards that a key must match up to in order to open the lock. Although it is 
the cheapest type of mechanical lock, it is also the easiest to pick. Pin-and-tumbler locks 
are considered more advanced. These locks contain more parts and are harder to pick 
than warded locks. When the correct key is inserted into the cylinder of a pin-and- 
tumbler lock, the pins are lifted to the right height so that the device can open or close. 
More advanced and technically complex than warded or pin-and-tumbler locks are cipher 
locks, which have a programmable keypad on which to enter a specific combination of 
numbers to open the lock. Figure 19.3 shows a cipher lock. 





Figure 19.3 One kind of cipher lock 


Locks are good physical deterrents and work quite well as a delaying mechanism, but a 
lock can be bypassed through lock picking. Lock picking is not the fastest way to bypass a 
lock but can be used to avoid detection. Criminals tend to pick locks because it is a 
stealthy way to bypass a lock and can make it harder for the victim to determine what has 
happened. 


The basic components used to pick locks are these: 


Tension Wrenches This type of wrench looks like a small, angled, flathead screwdriver. 
It comes in various thicknesses and sizes. 


Picks Similar to a dentist pick, these tools are small, angled, and pointed. 


Together, these tools can be used to pick a lock. One example of a basic technique used to 
pick a lock is scraping. With this technique, tension is held on the lock with the tension 
wrench while the pins are scraped quickly. Pins are then placed in a mechanical bind and 
will be stuck in the unlocked position. With practice, this can be done quickly so that all 
the pins stick and the locks are disengaged. Figure 19.4 shows a selection of lock-picking 





Figure 19.4 Lock-picking tools 


rat Lock-picking tools are readily available all over the Internet, including 
P, TE 


sites such as eBay and http://wallofsheep.com, where they can be purchased along 
with training materials on how to use them. Despite their availability, be careful 
when you purchase such devices, no matter what the reason. Different states and 
jurisdictions look at the possession of these tools differently. In California, for 


example, possession of these tools is not a crime, but committing a crime with them 
would be punishable by fines or jail time. 


However, in Nevada possession of these tools alone is against the law whether or not 
a separate crime was committed. In states such as Nevada the concept of prima facie 
comes into play; simply put, in these states an officer of the law discovering these 
tools can place an individual under arrest. 





Bump Keys Looking like a regular door key but slightly different is the bump key. A 
bump key is designed to fit into a lock, but is then adjusted. When employed with the 
right technique, a bump key can be used to open a large number of locks with little effort. 
It has been estimated that a burglar with a set of 10 keys designed for the most common 
locks can open around 90 percent of the locks on the market almost as well as if they had 
the real key itself. 


Contactless Cards 


Contactless cards do not require the card to be inserted or slid through a reader. These 
devices function by detecting the proximity of the card to the sensor. An example of this 
technology is radio frequency ID (RFID), an extremely small electronic device that 
contains a microchip and antenna. Many RFID devices are passive. Passive devices have 
no battery or power source because they are powered by the RFID reader. The reader 
generates an electromagnetic signal that induces a current in the RFID tag. 


Biometrics 


Another form of authentication is biometrics. Biometric authentication is based on a 
behavioral or physiological characteristic that is unique to an individual. Biometric 
authentication systems have gained market share and are seen as a good replacement for 
password-based authentication systems. Different biometric systems have varying levels 
of accuracy. The accuracy of a biometric device is measured by the percentages it 
produces of two types of errors. The false rejection rate (FRR) is a measurement of the 
percentage of individuals who should have gotten in but were not allowed access. The 
false acceptance rate (FAR) is a measurement of the percentage of individuals who gained 
access but should not have been allowed in. The corresponding individual errors are also 
known as type 1 and type 2 errors. Working with FRR and FAR is the crossover error rate 
(CER), which gives an indication of how accurate the system is. The CER is the point 
where the FRR and FAR are equal. Thus, the lower the value assigned to the CER, the 
more accurate the device is. 


Common biometric systems include the following: 


Finger Scan Systems Widely used and quite popular, these systems are installed in 
many new laptops. 


Hand Geometry Systems Accepted by most users, these systems function by 
measuring the unique geometry of a user’s fingers and hand to identify them. 


Palm Scan Systems These are much like the hand geometry systems, except they 
measure the creases and ridges of a user’s palm for identification. 


Retina Pattern Systems These systems, which examine the user’s retina pattern, are 
very accurate. 


Iris Recognition This eye recognition system is also very accurate; it matches the 
person’s blood vessels on the back of the eye. This type of system has not proven popular 


mainly because of the expense and the intrusiveness of the system when scanning the 
user. 


Voice Recognition This system determines who you are by using voice analysis. Voice 
recognition has not proven popular because it is easy to record a voice as well as the fact 
that a person’s voice can be affected by a cold and other factors. 


Keyboard Dynamics This biometric method analyzes the user’s speed and pattern of 
typing. 

No matter what means of authentication you use as a physical access control, it needs to 
fit the situation in which it will be applied. For example, if the processing time of a 
biometric system is slow, users will tend to just hold the door open for others rather than 
wait for the additional processing time. Another example is iris scanners, which may be 
installed at all employee entrances but evoke complaints from employees who are 
physically challenged or in wheelchairs since they cannot easily use the newly installed 
system. Consider who will be using the system and if it may be appropriate given the 
situation and user base. 


Walls, Ceilings, and Floors 


Of course, surrounding any facility and rooms are the walls, ceilings, and floors, which 
you should always consider when doing a physical penetration or assessment. Walls can 
be constructed and designed many different ways, but each situation should be 
considered carefully and assessed by someone who knows the various details that must 
be taken into account. 


First, look at the construction and composition of walls. Walls protecting key rooms 
within a facility should be sturdy and provide an effective barrier as well as a strong point 
for anchoring doors. 


One often-overlooked point is whether the walls are constructed as so-called false walls 
or if they are actually fully constructed. In some facilities, the walls may not extend up 
beyond the ceiling, which may not seem like a problem. However, in some cases facilities 
employ what is known as a false ceiling, which consists of a wall that only goes up to a 
drop ceiling and does not extend past the drop ceiling to the roof of the building. In cases 
like this, it is possible for an intruder to gain access to a restricted area simply by entering 
a crawlspace and going over the wall. 


In addition, any ceiling-mounted air ducts should be small enough to prevent an intruder 
from crawling through them. 


One other area to consider is the area under your feet, the floor. In some buildings the 
floor is raised, meaning there is a space underneath it. This space can present problems 
up to and including the passage of intruders or the placement of listening devices or other 
equipment. 


Finally, something that may not seem as obvious is how to protect facilities against 


vehicles. For example, how can a car or truck be stopped from backing into a window, 
breaking it, and allowing an intruder to quickly run in and steal something? The answer is 
bollards. Bollards are metal or rock barriers designed to thwart a vehicle-based attack. 
When a vehicle hits one of these devices it will be stopped by the bollard and cannot be 
used to crash into a building like a battering ram. 


Windows 


Depending on the placement and use of windows, anything from tinted to shatterproof 
windows may be required to ensure that security is preserved. It is also important to 
consider that in some situations the windows may need to have the existing security 
enhanced through the use of sensors or alarms. 


Window types include the following: 


Standard This is the lowest level of protection. It’s cheap but easily shattered and 
destroyed. 


Polycarbonate Acrylic Much stronger than standard glass, this type of plastic offers 
superior protection. 


Wire Reinforced A wire-reinforced window adds shatterproof protection and makes it 
harder for an intruder to break in and gain access. 


Laminated These windows are similar to what are used in an automobile. A laminate is 
added between layers of glass to increase the strength of the glass and decrease shatter 
potential. 


Solar Film Solar film provides a moderate level of security and decreases shatter 
potential. 


Security Film This type of transparent film is used to increase the strength of the glass 
in case of breakage or explosion. 


Entryways 


Something else that you may not readily think of is the protective measures present at the 
entry points of a facility. Looking at these points and directing some defenses at these 
locations is very advantageous and wise. In this section we will examine a few. 


Cameras 


Every entryway should have cameras covering the approach as well as areas in and 
around the entryway. These cameras should be positioned in such a way as to minimize 
or eliminate blind spots and catch the movement and approach of all parties that may be 
present. 


Bollards 


Another mechanism that may be required at and around the entry point of a facility is 


bollards. Bollards are structures designed to prevent the movement of vehicles into and 
out of an area. They can be the popup type, which rise up on demand from the ground, or 
they can be fixed in location. 


Another form for bollards to take is a less conspicuous design that performs the same 
purpose. These bollards can take the form of brick or stone flowerbeds. Another form is 
those that you may have seen outside some of the stores of the U.S. retailer Target. These 
bollards look like big red concrete balls but in reality are barriers designed to prevent a 
vehicle from being rammed into the entry of a store. 


Server Rooms and Networks 


Something that also needs to be included in this discussion is protecting server rooms. 
Since these rooms contain the living, breathing heart of your network, they require 
increased levels of protection. This security must be robust and carefully considered 
because an intruder in these areas can cause catastrophic damage. 


The server room needs to have several measures in place to avoid unnecessary and 
unwanted issues. Let’s look at a few of these: 


Controlled Entry No one who is unauthorized to be in the server room should be 
allowed entry unless they have been properly screened and/or escorted into and out of 
the area. 


Cameras Cameras should be carefully considered for inclusion both in and around the 
server room. These would be used to monitor the comings and goings of personnel in the 
area. 


Climate Control The room should be kept within a cooler range than other human- 
habitable parts of the building, and humidity should be carefully controlled. 


Rack-Mounted Servers One advantage that may not seem obvious with rack-mounted 
servers is that while they have a smaller footprint, they also are a lot easier to secure. 


Equipment Security In both the server room and other areas, devices such as switches, 
routers, and hubs (if you have them) should be locked up. An intruder can easily plug a 
drop box or even a notebook into these devices and capture traffic or cause other issues. 


Cable Protection Both in and out of the server room cables are vulnerable pieces of the 
network and as such should be physically protected against tampering. 


Fire Suppression While we can’t say much here about types and forms of fire 
suppression, such measures do need to be present. 


Positive Pressure Server rooms should have positive pressure maintained wherever 
possible in order to ensure dust, particles, and even smoke do not get drawn into the 
room but instead be pushed out or away. 


Access to these rooms should always be tightly controlled, and only trusted personnel 
should be allowed in the room. Also, when designing security for server rooms, be sure to 


design security from the inside out to ensure that what needs to be protected is getting 
protected. 


Other Items to Consider 


Just to be complete there are many other things that should be considered as part of a 
physical security plan that could be useful to an attacker: 


Protect Printers Protect these devices because they not only have hard copies of 
information coming out of them, but they can store documents in memory or on hard 
drives. Always take steps to keep these devices in access-controlled areas where they can’t 
easily be tampered with. 


Disable Drives Disable or lock drives such as legacy floppy drives or optical drives. In 
the case of optical drives, if they are still needed, limit or ban the use of drives that can 
write or rewrite media lest they become a method for pilfering data. 


Secure Backups Backups should never be located where they can be picked up and 
carried off. They should always be protected by being locked up and access to them 
restricted. 


Secure Portables Notebooks should be locked up when their user is away from them. If 
this is not practical, use cable locks to secure them to desktops. 


Use Case Locks Consider the use of case locks on desktop systems to prevent cases 
from being opened without a key. This will prevent someone from tampering with the 
internal components of a system. 


Lock Up Mobile Devices You should lock up tablets and small form factor devices 
when not in use. 


These are just a few options and things to think about as far as physical security goes, but 
there are many more. 


Education and Awareness 


One of the best lines of defense in security is vigilance and training. Employees and the 
people around your company should be trained on how to report suspicious activities and 
to whom. 


Employees should be taught to look for things that are out of the ordinary. Teach them to 
watch for items that seem out of place, people who are acting weird, or something that 
just doesn’t belong there. 


Another good habit to get employees into is to report callers or individuals who are asking 
abnormal questions or are making unusual requests. 


This list could go on and on, but you should look into developing a training and 
awareness program to cover your bases properly. 


Defense in Depth 


Something that we have mentioned a few times in this book is defense in depth. This 
concept originated from the military and is a way to delay rather than prevent an attack. 
As an information security tactic, it is based on the concept of layering more than one 
control. These controls can be physical, administrative, or technical in design. We have 
looked at a variety of physical controls in this chapter, such as locks, doors, fences, gates, 
and barriers. Administrative controls include policies and procedures and how you 
recruit, hire, manage, and fire employees. During employment, administrative controls 
such as least privilege, separation of duties, and rotation of duties are a few of the 
controls that must be enforced. When employees leave or are fired, their access needs to 
be revoked, accounts blocked, property returned, and passwords changed. Technical 
controls are another piece of defense in depth and can include methods such as 
encryption, firewalls, and IDSs. 


For the physical facility, a security professional should strive for a minimum of three 
layers of physical defense. The first line of defense is the building perimeter. Barriers 
placed here should delay and deter attacks. Items at this layer include fences, gates, and 
bollards. These defenses should not reduce visibility of CCTV and/or guards. Items such 
as shrubs should be 18 to 24 inches away from all entry points, and hedges should be cut 
6 inches below the level of all windows. 


The second layer of defense is the building exterior. This can be defined as the roof, walls, 
floor, doors, and ceiling of the building. Windows are a weak point here. Any opening 18 
feet or less above the ground should be considered a potential point of easy access and 
should be secured if greater than 96 square inches. 


Our third layer of physical defense is the interior controls. Examples of interior controls 
include locks, safes, containers, cabinets, interior lighting, and even policies and 
procedures that cover what controls are placed on computers, laptops, equipment, and 
storage media. This third layer of defense is important when you consider items such as 
the datacenter or any servers kept on site. Well-placed datacenters should not be above 
the second floor of a facility because a fire might make them inaccessible. Likewise, you 
wouldn’t want the datacenter located in the basement because it could be subject to 
flooding. A well-placed datacenter should have limited accessibility—typically no more 
than two doors. 


Summary 


In this chapter you learned that there are items that must be protected other than 
technical and administrative components, namely the physical components. Not 
everything you do will be focused on the technical, so you must learn how to protect your 
assets from physical threats. 


We discussed how those who perform malicious actions will often attempt to attack the 
physical component, as either a primary or a secondary means of attack. With the 


physical component sometimes overlooked or not properly considered, it is more than 
possible that a physical attack may be successful where other attacks have failed. Indeed, 
there have been numerous cases over the last two decades where attackers got what they 
wanted simply by entering a facility and retrieving it themselves. 


Exam Essentials 


Remember the basic concept of physical security. Be familiar with what physical 
security covers and what it does not. Also understand how physical security plays a part in 
thwarting attacks that may not be technical or administrative in nature. 


Understand the targets. Know what resources can, and usually do, get targeted. This 
applies also to the focus of the physical attack, which can be devices, storage media, 
laptops, and other devices. 


Understand the issues with construction. Understand that construction varies 
dramatically, with many different options and configurations that vary by location, 
industry, and intended use of a facility. If you are not familiar with how to evaluate 
physical components of a building or location, consider enlisting the help of experts in 
this area. 


Be familiar with preventive measures. Know the preventive measures available as 
well as the actions each one uses to prevent the attack. 


Review Questions 


1. 


Physical security can prevent which of the following? 
A. DDoS 

B. FTP 

C. Tailgating 

D. Cracking 


. Which of the following is a detective control when not used in real time? 


A. Fences 
B. Alarms 
C. CCTV 
D. Locks 


. Fora fence to deter a determined intruder, it should be at least how many feet tall? 


A. 4 

B. 6 

8 

10 

ee ____is used to prevent cars from ramming a building. 
. Honeypot 

Gates 

. Bollard 


. Fences 
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. While guards and dogs are both good for physical security, which of the following is a 


concern with dogs? 
A. Liability 

B. Discernment 
C. Dual role 

D. Multifunction 


. Which of the following is a good defense against tailgating and piggybacking? 


A. Cameras 


B. Guards 
C. Turnstiles 


D. Mantraps 


. Which of the following is a wall that is less than full height? 


A. Drop wall 
B. False wall 
C. Short wall 


D. Plenum wall 


. In the field of IT security, the concept of defense in depth is the layering of more than 


one control on another. Why is this? 
A. To provide better protection 

B. To build dependency among layers 
C. To increase logging ability 

D. To satisfy auditors 


. Which intrusion prevention system can be used in conjunction with fences? 


A. Infrared wave patter 
B. Bollards 

C. Audio 

D. PIDAS 


. Frequency of type 2 errors is also known as what? 


A. False rejection rate 
B. Failure rate 
C. Crossover error rate 


D. False acceptance rate 


. Which type of biometric system is frequently found on laptops but can be used on 


entryways as well? 
A. Retina 

B. Fingerprint 

C. Iris 


D. Voice recognition 


. Which of the following could be considered required components of an alarm system? 


A. A visual alerting method 
B. An audio alerting method 
C. Automatic dialup 

D. Both A and B 


. Lock-pick sets typically contain which of the following at a minimum? 


A. Tension wrenches and screwdrivers 
B. Apick 
C. Apick and a driver 


D. A pick and a tension wrench 


. During an assessment you discovered that the target company was using a fax 


machine. Which of the following is the least important? 
A. The phone number is publicly available. 

B. The fax machine is in an open, unsecured area. 

C. Faxes frequently sit in the printer tray. 


D. The fax machine uses a ribbon. 


. What is a drop ceiling? 


A. A false ceiling 
B. A tiled ceiling 
C. An insulated ceiling 
D. A weak ceiling 


. What is another word for portals? 


A. Doors 

B. Mantraps 
C. GlaDOS 
D. Booths 


. What is a type of combination lock? 


A. Key lock 
B. Card lock 
C. Cipher lock 
D. Trucker lock 


. What is the first defense that a physical intruder typically encounters? 


A. Fences 

B. Walls 

C. Bollards 

D. Cameras 

. What mechanism is intended to deter theft of hard drives? 
A. Locks 

B. Backups 

C. Encryption 

D. Size 


10. Which of the following is a characteristic of USB flash drives that makes security a 


problem? 

A. Encrypted 
B. Easily hidden 
C. Portable 
D. 


Slow 


Appendix A 
Answers to Review Questions 


Chapter 1: Introduction to Ethical Hacking 


1. 


A. A white-hat hacker always has permission to perform pen testing against a target 
system. 


. C. Ahacktivist is an individual or group that performs hacking and other disruptive 


activities with the intention of drawing attention to a particular cause or message. 


. A. Script kiddies have low or no knowledge of the hacking process but should still be 


treated as dangerous. 


. B. An ethical hacker never performs their services against a target without explicit 


permission of the owner of that system. 


. C. White-box testers have complete knowledge of the environment they have been 


tasked with attacking. 


. D. Much like suicide bombers in the real world, suicide hackers do not worry about 


getting caught; they are only concerned with their mission. 


. B. Code of ethics is a description of expected behavior. While not adhering to ethics 


typically does not result in legal action, it can result in expulsion from certain 
organizations such as EC-Council certification. 


. C. Anonymous is an example of hacktivists. 


9. A, B, C. Network performance is not the goal of security audits or penetration tests. 


o. C. Permission is absolutely essential to be obtained prior to performing any sort of test 


against a system you don’t own. Permission should also be in writing and never verbal. 


. C. Ahacktivist engages in mischief for political reasons. 


. B. Asuicide hacker does not worry about stealth or otherwise conceal their activities 


but is more concerned with forwarding an agenda. 


. B. Gray-hat hackers are typically thought of as those that were formally black hats but 


have reformed. However, they have been known to use their skills for both benign and 
malicious purposes. 


. D. Asuicide hacker’s main difference from other hackers is their complete and utter 


lack of concern in regard to being caught. 


. A. White hats are the most likely to engage in research activities, and although gray 


and black hats may engage in these activities, they are not typical. 


. B. Vulnerability research is a way of passively uncovering weaknesses. 


. A. Black-box testing is performed with no knowledge to simulate an actual view of 


what a hacker would have. 


. C. Acontract gives proof that permission and parameters were established. 


.g. A. TOE stands for target of evaluation and represents the target being tested. 


10. C. A vulnerability is a weakness. Worms, viruses, and rootkits are forms of malware. 


Chapter 2: System Fundamentals 


1. 


~OJ A Q 


D. Proxies operate at Layer 7, the Application layer of the OSI model. Proxies are 
capable of filtering network traffic based on content such as keywords and phrases. 
Because of this, a proxy digs down farther than a packet’s header and reviews the data 
within the packet as well. 


. B. Anetwork device that uses MAC addresses for directing traffic resides on Layer 2 of 


the OSI model. Devices that direct traffic via IP addresses, such as routers, work at 
Layer 3. 


. A. Windows remains king for sheer volume and presence on desktop and servers. 
. A. Port 443 is used for HTTPS traffic, which is secured by SSL. 
. D. Each port on a switch represents a collision domain. 


. D. Token ring networks use a token-based access methodology. Each node connected 


to the network must wait for possession of the token before it can send traffic via the 
ring. 


. A. Hubs operate at Layer 1, the Physical layer of the OSI model. Hubs simply forward 


the data they receive. There is no filtering or directing of traffic; thus, they are 
categorized at Layer 1. 


. B. Remember this three-way handshake sequence; you will see it quite a bit in packet 


captures when sniffing the network. Being able to identify the handshake process 
allows you to quickly find the beginning of a data transfer. 


. D. Transmission Control Protocol (TCP) is a connection-oriented protocol that uses 


the three-way-handshake to confirm that a connection is established. FTP and POP3 
use connections, but they are not connection-oriented protocols. 


. A. Port 23 is used for Telnet traffic. 
. D. Ports 49152 to 65535 are known as the dynamic ports and are used by applications 


that are neither well known nor registered. The dynamic range is essentially reserved 
for those applications that are not what we would consider mainstream. Although 
obscure in terms of port usage, repeated showings of the same obscure port during 
pen testing or assessment may be indicative of something strange going on. 


. C. Packet-filtering firewalls inspect solely the packet header information. 


. C. Intrusion detection systems (IDSs) react to irregular network activity by notifying 


support staff of the incident; however, unlike IPSs, they do not proactively take steps 
to prevent further activity from occurring. 


. D. Atrue mesh topology creates a natural amount of redundancy due to the number of 


connections used to establish connectivity. 


C. Because each switchport is its own collision domain, only nodes that reside on the 


same switchport will be seen during a scan. 


. D. A proxy acts as an intermediary between internal host computers and the outside 


world. 


. D. Network Address Translation (NAT) is a technology that funnels all internal traffic 


through a single public connection. NAT is implemented for both cost savings and 
network security. 


. C. An intrusion prevention system (IPS) plays an active role in preventing further 


suspicious activity after it is detected. 


. D. Simple Mail Transfer Protocol (SMTP) operates on port 25 and is used for outgoing 


mail traffic. In this scenario, the IDS SMTP configuration needs to be updated. 


. D. A packet-filtering firewall operates at Layer 7 (and all layers) of the OSI model and 


thus filters traffic at a highly granular level. 


Chapter 3: Cryptography 


1. 
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A. Symmetric cryptography is also known as shared key cryptography. 


D. A certificate authority is responsible for issuing and managing digital certificates as 
well as keys. 


. B. Asymmetric encryption uses two separate keys and is referred to as public key 


cryptography. Symmetric algorithms use only one key that is used by both the sender 
and receiver. 


. C. Hashing is referred to as a cipher or algorithm or even a cryptosystem, but it can be 


uniquely referred to as a nonreversible mechanism for verifying the integrity of data. 
Remember that hashing doesn’t enforce confidentiality. 


. C. A message digest is a product of a hashing algorithm, which may also be called a 


message digest function. 


. C. A public and private key are mathematically related keys, but they are not identical. 


In symmetric systems only one key is used at a time. 


. B. A public key is not necessarily stored on the local system, but a private key will 


always be present if the user is enrolled. 


. A. The number of keys increases dramatically with more and more parties using 


symmetric encryption; hence it does not scale well. 


. A. Hashing is intended to verify and preserve the integrity of data, but it cannot 


preserve the confidentiality of that data. 


. A. MDs5 is the most widely used hashing algorithm, followed very closely by SHA1 and 


the SHA family of protocols. 


. C. PGP is a method of encrypting stored data to include emails, stored data, and other 


similar information. It is a form of public and private key encryption. 


. B. SSLis used to secure data when it is being transmitted from client to server and 


back. The system is supported by most clients, including web browsers and email 
clients. 


. D. PKI is used in the process of making SSL function. While it is true that AES, DES, 


and 3DES can be used in SSL connections, PKI is the only one used consistently in all 
situations. 


. C. IPsec operates at the Network layer, or Layer 3, of the OSI model, unlike many 


previous techniques. 


. C. The Authentication Header provides authentication services to data, meaning that 


the sender of the data can be authenticated by the receiver of the data. 


A. Data security services are provided by ESP. 


\7. D. Data can be protected using SSL during transmission. If data is being stored on a 


8. 


hard drive or flash drive, SSL is not effective at proving cryptographic services. 


D. PKI is used with IPsec to allow it to function in environments of any size. IPsec is 
also capable of using Preshared Key if desired by the system owner. 


. A. Netscape originally developed SSL, but since its introduction the technology has 


spread to become a standard supported by many clients such as email, web browsers, 
VPNs, and other systems. 


. A. IPsec uses two modes: Authentication Header (AH) and Encapsulating Security 


Payload (ESP). Both modes offer protection to data but do so in different ways. 


Chapter 4: Footprinting 


1. 
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D. Footprinting is the gathering of information relating to an intended target. The idea 
is to gather as much information about the target as possible before starting an attack. 


C. Port scanning is typically reserved for later stages of the attack process. 


. A. Google hacking is used to produce more targeted and useful search results than 


would be possible using normal searches. 


. C. Social engineering can gain information about computers and other items, but it 


does so by interacting with people to extract that information. 


. B. EDGAR can be used to verify the financial filings of a company. 


. B. Operators such as filetype are used to manipulate search results for some search 


engines such as Google. 


. A. Job boards are useful in getting an idea of the technology within an organization. By 


looking at job requirements, you can get a good idea of the technology present. While 
the other options here may provide technical data, job boards tend to have the best 
chance of providing it. 


. C. Street-level views using technology such as Google Street View can give you a 


picture of what types of security and access points may be present in a location. 


9. A. Social engineering can reveal how a company works. 


o. C. The Wayback Machine is used to view archived versions of websites if available (not 


17. 


all websites are archived via the Wayback Machine). 


. D. MX records are DNS records used to locate the mail server for a domain. 


. B. Netcraft can be used to view many details about a web server, including IP address, 


netblock, last views, OS information, and web server version. 


. C. Alerts can be set up with Google as well as other search engines to monitor changes 


on a given website or URL. When a change is detected, the alert is sent to the 
requestor. 


. C. Scanning comes after the footprinting phase. Footprinting is used to get a better 


idea of the target. 


. D. Competitive analysis can prove very effective when yow’re trying to gain more 


detailed information about a target. Competitive analysis relies on looking at a target’s 
competitors in an effort to find out more about the target. 


. D. While a computer, email, or phone may be used, social engineering ultimately uses 


other items as tools to gain information from a human being. 


A. Social networking has proven especially effective for social engineering purposes. 
Due to the amount of information people tend to reveal on these sites, they make 


prime targets for information gathering. 


. D. Footprinting is not very effective at gaining information about the number of 
personnel. 


. B. Footprinting is typically broken into active and passive phases, which are 
characterized by how aggressive the process actually is. Active phases are much more 
aggressive than their passive counterparts. 


‘Oo. B. Tracert is a tool used to trace the path of a packet from source to ultimate 


destination. 


Chapter 5: Scanning 


1. 


A. Telnet is used to perform banner grabs against a system. However, other tools are 
available to do this as well. 


. B. Netcraft is used to gather information about many aspects of a system, including 


operating system, IP address, and even country of origin. 


. D. Nmap is a utility used to scan networks and systems and for other types of custom 


scans. 


4. D. END is not a type of flag. Valid flags are ACK, FIN, SYN, URG, RST, and PSH. 


5. A. SYN flags are seen only on TCP-based transmissions and not in UDP transmissions 


of any kind. 


. B. ANULL scan has no flags configured on its packets. 
. B. An ACK flag belongs to the last part of the three-way handshake, and this part never 


happens in a half-open scan. 


. B. An RST indicates that the port is closed. 
. B. An RST indicates the port is closed in many of the TCP scan types. The RST is sent 


in response to a connection request and the RST indicates that the port is not 
available. 


. A. The three-way handshake happens at the beginning of every TCP connection. 
. C. Athree-way handshake is part of every TCP connection and happens at the 


beginning of every connection. In the case of a half-open scan, however, a final ACK is 
not sent, therefore leaving the connection halfway complete. 


. A. A three-way handshake is part of every TCP connection and happens at the 


beginning of every connection. It includes the sequence SYN, SYN-ACK, ACK to be 
fully completed. 


3. A. An ICMP echo scan is a ping sweep-type scan. 


4. D. Vulnerability scans are designed to pick up weaknesses in a system. They are 


typically automated. 


. C. A proxy is used to hide the party launching a scan. 


. B. Tor is designed to hide the process of scanning as well as the origin of a scan. In 


addition, it can provide encryption services to hide the traffic itself. 


. A. You do not need to use a proxy to perform scanning, but using one will hide the 


process of scanning and make it more difficult to monitor by the victim or other 
parties. 


. A, B. Vulnerability scanners are necessary for a security person to use to strengthen 


their systems by finding weaknesses before an attacker does. 


9. D. A banner can be changed on many services, keeping them from being easily 
identified. If this is not done, it is possible to use tools such as Telnet to gain 
information about a service and use that information to fine-tune an attack. 


‘0. A. Nmap is designed to perform scans against ports on a system or group of systems, 
but it is by far the most popular tool in many categories. 


Chapter 6: Enumeration 
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D. Usernames are especially useful in the system hacking process because they allow 
you to target accounts for password cracking. 


. C. Ports are usually uncovered during the scanning phase and not the enumeration 


phase. 


. A. Zone transfers are used to retrieve a copy of the zone file from a server and store it 


in another location. 


. A. vrfy cheli, the verify command, is used within SMTP to verify that the object 


provided is legitimate. 


. A. verry validates an email address in SMTP. 
. B. The expen command will display the recipients of an email list. 


. A. NetBIOS can be used to enumerate the users on a system. 


A. A NULL session can be used to connect to a remote system via the ipcs share. 


. B. NTP (Network Time Protocol) is used to synchronize clocks on a network. 
. A. Port 25 is for SMTP. 
. A. Port 53 TCP is used by DNS for zone transfers. 


. C. nbtstat lets you view information about NetBIOS. 


3. C. SNScan is designed to access and display information for SNMP. 


4. C. SMTP is primarily intended to transfer email messages from email servers and 


clients. 


. D. Ports 161 and 162 are used by SNMP. 


. B. LDAP is used to query and structure databases; this database could include a 


directory service, but it is not necessarily one. 


. C. SNMP is used to monitor and send messages to network devices. 


. A. SNMP is designed to aid in the management of devices by transmitting and 


receiving messages known as traps. 


. C. An SID is used to identify a user. 


o. C. Azone transfer is used to synchronize information, namely records, between two or 


more DNS servers. 


Chapter 7: System Hacking 


1. 


A, D. Usernames are especially useful in the system-hacking process because they let 
you target accounts for password cracking. Enumeration can provide information 
regarding usernames and accounts. 


. C. Ports are usually uncovered during the scanning phase and not the enumeration 


phase. 


. A. Netcat uses the syntax nc -1 -p to listen on a specific port, with the port number 


being specified as a number following the-p. For example, nc -1 -p 1000 would tell 
the server to listen on port 1000 for incoming connections. 


4. A. System hacking is intended to increase access to a system. 


5. A. Brute-force attacks are carried out by trying all possible combinations of characters 


in an attempt to uncover the correct one. 


. B. Arainbow attack or rainbow table attack is designed to generate the hashes 


necessary to perform an offline attack against an extracted hash. 


. A. A backdoor gives an attacker a means to come back to the system later for further 


attacks. 


. B. A password hash is commonly used to represent a password in an encrypted format 


that is not reversible in locations such as the SAM database. 


9. B. The SAM database is used to store credential information on a local system. 


o. A. LM is a hashing format used to store passwords. 


. A. SYSKEY is used to partially encrypt the SAM database in Windows versions from 


NT 4 onward. 


. C. Kerberos is the authentication mechanism preferred over LM and NTLM (all 


versions). 


. B. NTLM is a more secure protocol than LM. A little stronger still is NTLMv2, which 


provides additional features such as mutual authentication and stronger encryption. 


4. C. NTFS is required in order to use ADS. 


5. D. Auditpol is used to stop the logging of events on a Windows system. 


. B. LM hashing is disabled on newer Windows systems, but it can be re-enabled for 


legacy support. 


. A. Trinity Rescue Kit (TRK) is a Linux distribution used to reset passwords. 


. A. Complex passwords are a great defense against password guessing. 


D. NTLMv2 should be used if a domain controller is not present. 


C. Alternate Data Streams are only supported on NTFS. None of the other file systems 


available in Windows currently support the ADS feature. 


Chapter 8: Malware 


1. 


B, C. Malware covers all types of malicious software, including viruses, worms, 
Trojans, spyware, adware, and other similar items. 


. A, C. Unlike a worm, a virus requires that a user interact with it or initiate replication 


in some manner. 


. D. Typically a virus does not display pop-ups. That is a characteristic of adware. 


4. A, B. Aworm replicates without user interaction. 


5. A. Worms are typically known for extremely rapid replication rates once they are 


released into the wild. 


. A. Netstat -a Or -an lists ports on a system that are listening in Windows. 


. B. TCPView lists ports and their statuses in real time. 


8. D. TCPTROJAN is not a Trojan. All the other utilities on this list are different forms of 


Trojans. 


9. B. Hardware keyloggers are not difficult to install on a target system. 


o. C. Netcat can do port redirection. 


. C. A Trojan relies on social engineering to entice the victim to open or activate the 


payload. 


. A. Aremote access Trojan (RAT) is a common payload to include in a Trojan. 


. C. Acovert channel is a backdoor or unintended vulnerability on a system that may or 


may not be created through the use of a Trojan. 


. A. An overt channel is a mechanism on a system or process that is typically put in 


place by design and intended to be used a specific way. 


. C. Asoftware development kit (SDK) is used to develop software but not to detect a 


covert channel. 


. C. Typically, a RAT is not used to sniff traffic, but it may be used to install software to 


perform this function. 


. B. Alogic bomb comes in two parts: a trigger and a payload. The payload stays 


dormant until the trigger wakes it up. 


. A, C, D. A logic bomb may be activated by any of these options except the presence of a 


vulnerability. 


. C. A polymorphic virus evades detection through rewriting itself. 


‘0. C. Asparse infector evades detection by infecting only a handful or selection of files 


instead of all of them. 


Chapter 9: Sniffers 


1. 


D. Each switchport represents a collision domain, thereby limiting sniffing to only the 
clients residing on that port. 


. A. All wireless access points are essentially hubs in that they do not segregate traffic 


the way a traditional wired switch does. 


. D. An NIC must be configured to operate in promiscuous mode to capture all traffic on 


the network. More specifically, it allows the interface to capture both traffic that is 
intended for the host and traffic that is intended for other clients. 


. B. IP DHCP Snooping can be used on Cisco devices to prevent ARP poisoning by 


validating IP-to-MAC mappings based on a saved database. 


. C. Jennifer can implement a form of encryption for the traffic that she wants to 


protect from sniffing. Secure Shell traffic would not be readable if captured by a 
sniffer; however, any legitimate network troubleshooting efforts would also prove 
more challenging because of packet encryption. 


. C. MAC spoofing results in duplicate MAC addresses on a network unless the 


compromised client has been bumped from its connection. Two IP addresses mapping 
to one MAC indicates a bogus client. 


. A. Bob can launch a MAC flooding attack against the switch, thereby converting the 


switch into a large hub. If successful, this will allow Bob to sniff all traffic passing 
through the switch. 


. B. ARP poisoning alters ARP table mappings to align all traffic to the attacker’s 


interface before traveling to the proper destination. This allows the attacker to capture 
all traffic on the network and provides a jumping-off point for future attacks. 


. C. The Wireshark operator == means equal to. In this scenario, using the == operator 


filters down to 192.168.1.1 as the specific host to be displayed. 


. A. Cain & Abel is a well-known suite of tools used for various pen-testing functions 


such as sniffing, password cracking, and ARP poisoning. 


. C. The command for the CLI version of Wireshark is tshark. 


. D. Tecpdump uses the option -w to write a capture to a log file for later review. The 


option -r is used to read the capture file, or the capture can be opened in a GUI-based 
sniffer such as Wireshark. 


. A. Wireshark filters use the basic syntax of putting the protocol first followed by the 


field of interest, the operator to be used, and finally the value to look for (tcp .port 
22023). 


. B. Tiffany looks for NetBIOS traffic on port 139. She can use the filter string tcp .port 


eq 139. 


C. This question may seem unfair, but the exam will expect you to take what looks like 
unrelated data and extrapolate those parts that make sense. Remember, catching only 
the first octet of an IPv4 address is enough to give you a firm indication of what the 
question is asking. 


. A. The option -r is used to read the capture file, or the capture can be opened in a 


GUI-based sniffer such as Wireshark. 


. B. To sniff all traffic on a network segment, promiscuous mode is required, which 


allows all network traffic to be captured. 


. B. Aswitch can limit sniffing to a single collision domain, unlike a lesser device such 


as a hub. 


. A.A hub cannot limit the flow of traffic in any way, meaning that all traffic flowing 


through the hub can be viewed and analyzed. 


. B. Tcpdump is a command-line equivalent of WinDump, which allows the sniffing of 


network traffic. 


Chapter 10: Social Engineering 
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B. Phishing is performed using email to entice the target to provide information of a 
sensitive nature. 


. A, B. Training and education are specifically used to prevent the practice of tailgating 


or piggybacking. Attacks such as session hijacking can’t be prevented through training 
and education of end users. 


. A, B, C. Technology alone cannot stop the impact of social engineering and must be 


accompanied by other mechanisms as well, such as education. The strongest defense 
against social engineering tends to be proper training and education. 


. A, B, C, D. The targets of social engineering are people and the weaknesses present in 


human beings. 


. D. Social engineering takes advantage of many mechanisms, including Trojan horses, 


but it does not use viruses. However, instant messaging, mobile phones, and Trojan 
horses are all effective tools for social engineering. 


. A. Social engineering is designed to exploit human nature with the intention of 


gaining information. 


. A, B. Education and spam filtering are tremendously helpful at lessening the impact of 


phishing. Pure antivirus and anti-malware typically do not include this functionality 
unless they are part of a larger suite. 


. A. Appearance can easily impact the opinion that an individual or a group has about 


someone. The other options here are types of countermeasures used to stop physical 
attacks. 


. A. This type of attack is a clear example of phishing: An attacker crafts an attractive- 


looking email with the intention of enticing the victim to perform an action. 


. B. Training is the best and most effective method of blunting the impact of social 


engineering. Addressing the problem through education can lessen the need for some 
countermeasures. 


. C. This is an example of phishing because it involves enticing the user to click a link 


and presumably provide information. 


. C. This attack is most likely the result of identity theft, and while we don’t know 


exactly how it was stolen, candidates include phishing, social engineering, keyloggers, 
or Trojan horses. 


. D. This attack is called tailgating and involves a person being closely followed by 


another individual through a door or entrance. 


. D. Avulnerability scan is designed to pick up weaknesses in a system. Such scans are 


typically automated. 


C. An attacker could keep their activities masked and covered up to prevent 
themselves from being discovered. 


. B. Phishing is a social engineering attack designed to gather information from victims 


using email. 


. B. Habits are set patterns of behavior that individuals tend to follow or revert to 


frequently. 


. B. Using keywords or buzzwords can make a victim believe the attacker is in the know 


about how a company works. 


. C. Name-dropping can be used by an attacker to make a victim believe the attacker has 


power or knows people who are in power. 


. C. This attack is most likely a result of identity theft. The information to carry out this 


attack may have been obtained through the use of techniques such as phishing or 
social engineering. However, those techniques can be used for other attacks as well 
and not just identity theft. 


Chapter 11: Denial of Service 


1. 


B. 0x90 is the hexadecimal value of a NOP instruction for Intel-based systems. 
Remember to keep an eye out for this value; it indicates a NOP and possibly a NOP 
sled, which could indicate a buffer overflow condition in progress. 


. C. Asuccessful overflow attack can change the value of an Extended Instruction 


Pointer (EIP) saved on the stack. 


. D. Hacktivists get their title from the paradigm of hacktivism. These hackers launch 


attacks against targets because they believe those targets violate the attackers’ morals, 
ethics, or principles. 


. D. Throttling network traffic will slow down a potential DoS attack; however, an 


ingress filter will check for internal addresses coming in from the public side. This is a 
good indicator of a spoofed IP. 


. A. Aland attack fits this description. Smurf Attacks deal with ICMP echo requests 


going back to a spoofed target address. SYN floods use custom packets that barrage a 
target with requests. Teardrop attacks use custom fragmented packets that have 
overlapping offsets. 


. B. Adding an item to the stack is known as pushing, and removing an item from the 


stack is known as popping. Remember that adding and removing occur only at the top. 


. C. Reverse proxies are implemented to protect the destination resource, not the client 


or user. In this scenario, a reverse proxy will field all outside requests, thereby 
preventing direct traffic to the web server and reducing the risk of a DoS attack. 


. A. A DDoS attacker commonly uses IRC to communicate with handlers, which in turn 


send the attack signal to the infected clients (zombies). 


. B. Along with the stack, the heap provides a program with a dynamic memory space 


that can serve as a nonsequential storage location for variables and program items. 


. A, B, C, D. All of these C functions are considered dangerous because they do not 


check memory bounds. Thus, code containing any of these can be part of a buffer 
overflow attack. 


. B. The stack uses a last-in, first-out scheme. Items are pushed onto or popped from 


the top, so at any time the only accessible item on the stack is the last one pushed 
there. 


. B. Looking at the amount of SYN flags without a full handshake, it appears a SYN 


flood is occurring. 


. C. The DDoS tool Low Orbit Ion Cannon (LOIC) is a single-button utility that is 


suspected of being used in large-scale DDoS attacks. 


. B. Targa has eight different DoS attacks included in its capabilities. TFN2K and Trinoo 


are designed to carry out DDoS attacks and be a part of a botnet. 


D. Although the Nmap and Zenmap utilities can activate specific TCP flags based on 
the custom scan desired, the hping3 utility was designed for creating custom packets 
and manipulating TCP flags. 


. C. UDP is the protocol that is used to carry out a Fraggle Attack. ICMP plays a role in 


ping floods, which are a different type of attack. TCP and IPX do not play any role in 
this type of attack. 


. A.A Smurf Attack uses ICMP to carry out its action whereas UDP is used during 


Fraggle Attacks. TCP is not used in either attack. 


. B. The main difference between the two types of attacks is the number of attackers. 


The goal is the same and the scale is different but hard to define. Protocols have no 
bearing and are irrelevant. 


. C. Although any of these options could be symptomatic of a DoS attack, the most 


common is slow performance. 


. A. During a SYN flood, the last step of the three-way handshake is missing, which 


means that after the SYN and SYN-ACK are performed, the final ACK is not received. 


Chapter 12: Session Hijacking 


1. 


C. Session hijacking focuses on the victim’s session. There are different ways of 
accomplishing this task, but the basic concept is the same. Be sure to know what 
constitutes a session hijack; the exam will expect you to be able to recognize one at 
first glance. 


. A. Julie is operating in the passive sense in this scenario. Sniffing traffic is a passive 


activity. 


. D. Man-in-the-middle (MITM) attacks are an exam favorite; just remember that the 


broader category of session hijacking encompasses MITM attacks. Anytime you see a 
computer placed in the middle, you should immediately suspect MITM or session 
hijacking. 


. A. An excessive number of ARP broadcasts would indicate an ARP poisoning attack. 


The users’ reporting loss of connectivity may indicate an attempted session hijacking 
with a possible DoS attack. 


. C. URLs, cookies, and hidden logins are all sources of session IDs. 


. C. Null values are used to increment the sequence numbers of packets between the 


victim and the host. The null packets are sent to the host machine in an effort to 
prepare for desynchronizing the client. 


. B. Source routing specifies the path the packet will take to its destination. Source 


routing can give an attacker the flexibility to direct traffic around areas that may 
prevent traffic flow or redirect traffic in an undesired fashion. 


. B. Stealing session IDs is the main objective in web session hijacking. Session IDs 


allow the attacker to assume the role of the legitimate client without the time- 
consuming task of brute-forcing user logins or sniffing out authentication 
information. 


. A. Asession ID coded directly into a URL is categorized as a URL-embedded session 


ID. Remnant session information left in a browser’s history can potentially lead to 
another user or attacker attempting to reuse an abandoned session. 


. D. The key portion of the question is that Julie is not receiving a response to her 


injected packets and commands. Although the sequence prediction does relate to TCP 
hijacking, the best answer is blind hijacking. 


. D. IPSec is designed with many goals in mind; one of them is that it is not as 


vulnerable to session hijacking as the other protocols and services listed here. 


. A. IPsec provides encryption and other related services that can thwart the threat of 


session hijacking. 


. A. Web applications can be vulnerable to session fixation if the right conditions exist. 


Typically, this means that session IDs are not regenerated often enough or can be 


easily ascertained. 


. C. Authentication mechanisms such as Kerberos can provide protection against 


session hijacking. Authentication provides verification of the party or parties involved 
in the communication. 


. C. XSS is targeted toward web browsers and can take advantage of defects in web 


applications and browsers. 


. D. Trojans are commonly used to deploy malware onto a client system, which can be 


used to perform a session hijack. 


. C. Aman-in-the-middle attack occurs when the attacking party inserts themselves into 


the communication between two different parties. 


. A. Session hijacks can occur with both network and application traffic, depending on 


the attacker’s desired goals. 


. D. Cookies can be used during a session hijack and indeed the information contained 


therein may be the goal of the attack, but devices alone cannot initiate an attack. 


. D. Asession hijack can be used to read cookies on a client but not place a cookie on a 


server. 


Chapter 13: Web Servers and Applications 


1. B. A web application is code designed to be run on the server with the results sent to 
the client for presentation. 


2. A. JavaScript is a client-side scripting language as opposed to languages such as ASP 
and ASP.NET. 


3. B. PHP is a server-side language that has its actions handled by the server before 
delivering the results to the requester. 


4. D. Directory traversals are used to browse outside the root of the site or location and 
access files or directories that should otherwise be hidden. 


5. B. Input validation is the process of checking input for correctness prior to its being 
accepted by an application. Unlike filtering, which works on the server side, validation 
works on the client side and prevents bad input from making it to the server. 


6. B. A banner grab can be used to connect to a service and extract information about it. 


7. A. Defense in depth provides much better protection than a single layer. It also 
provides a means of slowing down and frustrating an attacker. 


8. C. Access control lists (ACLs) are used to set permissions on web content and prevent 
or control certain levels of interaction by users. 


9. D. Logs can be used to monitor activity on a system, including web applications or web 
servers. 


o. B,C, D. Each of these flags can be used to provide security for a cookie, which 
wouldn’t otherwise be provided. 


11. A. SSL, specifically SSL 3.0, is targeted in this attack. This attack is possible when a 
browser cannot use TLS so instead switches to SSL 3.0, which has been deprecated. 


2. A. A cookie is used to store session information about browsing sessions and is a file 
that resides on a client. 


.3. B. Session hijacking can be used to take over an existing session that has been 
authenticated or to forge a valid session. 


4. A. The command nc <target ip address> <port number> would allow a banner grab. 
Once the connection is established, you would issue the command zap / HTTP/1.0 to 
retrieve HTTP headers. 


5. A. Brute-force attacks are carried out by trying all possible combinations of characters 
in an attempt to uncover the correct one. 


6. A. The correct command for retrieving header information from a website is telnet 


<website name> 80. 


r= 


7. D. Hacktivists get their title from the paradigm of hacktivism. These hackers launch 


attacks against targets because they believe those targets violate the attackers’ morals, 
ethics, or principles. 


8. C. The Wayback Machine is used to view archived versions of websites if available. Not 
all websites are archived on the Wayback Machine, however. 


9. A. Encryption offers the ability to prevent content from being viewed by anyone not 
specifically authorized to view it. 


10. D. Buffer overflows are a common flaw in software that typically can be fixed only by a 
software engineer. 


Chapter 14: SQL Injection 


1. 


A, D. Input validation is intended to prevent the submission of bad input into an 
application, which could allow SQL injection to take place. 


. A. Web applications are ideally suited for providing dynamic content of all types. 


Although some of this can be done on the client side, there is much more power and 
capability on the server side. 


. B. Firewalls can prevent the scanning of systems and the probing or discovery of a 


database. 


. A. Databases can be a victim of source code exploits, depending on their configuration 


and design. 


. A. A hierarchical database is an alternative to the popular relational database 


structure. 


. C. CGI is a scripting language that is designed to be processed on the server side 


before the results are provided to the client. 


. C. SQLPing is used to audit databases and help identify issues that may be of concern 


or problematic. 


. B. Browsers do not render hidden fields, but these fields can be viewed if you use the 


browser’s ability to view source code. 


. B. SQL injection attacks are made possible through improper input validation, thus 


allowing bogus commands to be issued to a database and processed. 


. B. SQL injection can be used to attack databases. 


. C. The xp_cmdshell command is available in all versions of SQL Server and can be 


used to open a command shell. The command has been disabled in current versions of 
the product, though it is still available to be enabled. 


. B,C, D. The senect command is used to craft SQL queries, whereas wHERE and FRom are 


used to customize queries to get more desirable results. 


3. B. The wHere statement limits the results of a SQL query. 


4. D. The drop table command is used to remove a table from a database. This 


command deletes a table from the database. 


. C. SQL injection operates at the database layer and attacks databases directly. 
. A. Arow is a name for a line in a database typically associated with a record. 


. C. Adistributed database is one that has its information spread across many different 


systems that are networked together and linked via code. 


. B. Arelational database uses complex relationships between tables to describe data in 


an understandable format. 


9. D. Error messages can reveal success of an attack, failure of an attack, structure of a 
database, as well as configuration and other information. 


‘0. A. When error messages are not descriptive or not available, a blind SQL injection 
attack can be used to ascertain information from performance or indirect 
observations. 


Chapter 15: Hacking Wi-Fi and Bluetooth 


1. 


B. WEP is intended to offer security comparable to that experienced on traditional 
wired networks. In practice the security has been less than intended. 


A. 802.11a operates exclusively at the 5 GHz frequency range, whereas 802.11b and 
802.11g operate at the 2.54 GHz range. The newer 802.11n standard can operate at 
both frequency ranges. 


. D. 802.11i specifies security standards for wireless and is not concerned with 


specifying new network standards for communication. WPA and WPA2 are designed 
to be compatible with this standard. 


. D. WEP is by far the weakest of the protocols here; WPA is the next stronger, and 


WPAz2 is the strongest of the group. Open implies little or no protection at all. 


. A. The purpose of a site survey is to map out a site and locate access points and other 


wireless-enabled devices. 


. D. When two clients attach to each other in a wireless setting, it is known as an ad hoc 


network. 


. A. In an infrastructure network the client attaches directly to an access point instead 


of another client. 


. B. Bluesnarfing is used to read information from a Bluetooth-enabled device. 


. C. Monitor mode is a feature supported by wireless network cards that allows the 


capturing of wireless traffic from unassociated wireless networks. 


. C. Honeyspots are intended to attract victims to attach to it with the intention of 


gathering information. 


. A. SSIDs serve many functions, but the primary goal is to identify the network to 


clients or potential clients. SSIDs are configurable by the owner of the network and 
should be changed from their defaults in every case. 


. A. AirPcap is a device designed to allow in-depth analysis of traffic on wireless 


networks. The device is typically used with software such as Wireshark. 


. A. Arogue access point is one not managed by the organization and may be set up by 


an attacker or may even be set up by an employee trying to circumvent the rules. 


. C. Bluejacking is a means of sending unsolicited messages to a Bluetooth-enabled 


device. 


. A. Wardriving is used to locate wireless networks when using a mobile device as you 


are traveling around a city or neighborhood. Typically a GPS is also included to 
pinpoint networks. 


. C. Warchalking is used specifically to draw others’ attention to the presence of a 


wireless network. The practice consists of drawing chalk symbols in the area of a 


detected wireless network that indicates the name, channel, and other information 
about the network. 


. B. Aclosed network is typically considered a private network and not meant for public 


use. The network is usually not visible, and you can locate and connect to it only if you 
already know the SSID. 


B. WPS support is a feature of WPA and later networks that allows push-button 
association of wireless clients to access points. 


C. A PSK is entered into each client that is going to access the wireless network. It is 
commonly found in WEP, WPA, and WPA2 deployments. PSKs represent a security 
risk because they can be extracted from a compromised client and then allow a 
malicious party to access the network. 


. D. A Wi-Fi jammer can be used to shut down a wireless network while it is running. 


Chapter 16: Mobile Device Security 


1. 
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B. Encryption safeguards data on devices that have been lost or stolen. 


C. Jailbreaking refers to gaining root access on a mobile device, specifically iOS 
devices. 


. C. Rooting is the process of increasing the amount of access a user has on an Android 


device. 


4. D. Android is based on Linux. 
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. B. iOS is based on OS X. 


. A, C, D. A company should proactively set passwords and use encryption, as well as 


employ remote wipe on a mobile device in the event that it is lost or stolen. 


. C. WPScan is used to look for weaknesses in WordPress sites. 

. C. Psiphon is essentially a VPN technology that would thwart sniffing of traffic. 
. B. DroidSheep is used to perform session hijacks. 

. B. SandroProxy would be useful to disguise the source of a scan. 


. A. If Install From Unknown Sources is enabled on Android devices, unsafe or 


unprotected applications could compromise a device, but still will be installed. 


. A. IPsec can protect against session hijacking. 


. B. Security is lowered on a device when rooting in performed. 


D. Psiphon would provide some protection against sniffing and session hijacking. 


. B. LOIC is software used to perform denial of service attacks. 


. A. Much like desktop systems, installing an antivirus can prevent this type of malware 


based attack. 


. C. FaceNiff is used to take over active sessions. 


8. A, B. Remote wipes remove data and other sensitive information from a device. 


. C. Worms do not cause session hijacks. 


‘0. A, B. NetCut can test a firewall and craft packets. 


Chapter 17: Evasion 


1. 


D. An HIDS (host-based intrusion detection system) is used to monitor security 
violations on a particular host. 


. C. Port scanning can be used to identify certain firewalls because specific ports are 


known to be open and available on some firewalls. 


. A. An NIDS includes extra features not found in programs such as Wireshark, but at 


its core it functions in a similar way to a packet sniffer. 


. D. Encryption can be used to avoid specific types of firewalls because of their inability 


to decrypt the traffic. 


. D. You can evade an NIDS by altering a checksum because some systems cannot 


handle the differences in checksums on a packet when encountered. 


. D. Firewalking can be used to analyze the configuration and rules on a firewall. 


. B. An insertion attack is one where packets that would be dropped by an end system 


are accepted by the IDS. Because the IDS accepts packets, it results in a denial of 
service with some IDSs. 


. C. When a packet is fragmented and directed at an IDS, but only part of the fragments 


are sent or received, the fragments will continue to consume memory on some IDSs. 
The reason is that a less-capable or less-intelligent IDS will hold onto the fragments 
while they wait for the remainder, thus consuming memory. 


. A. Signature files are used by IDSs to match traffic against known attacks to determine 


if an attack has been found or if normal traffic is present. 


. B. An anomaly-based NIDS is designed to look for deviations from known traffic 


patterns and behaviors on the network. Such NIDSs need to be tuned to the network 
they are connected to. 


. B. Multihomed firewalls are defined typically as having three or more network 


connections. 


. B. Amultihomed firewall can be used to create a DMZ as can two separate firewalls. In 


either case, a buffer zone between public and private networks is created. 


. A. Networks are separated into different zones of trust through the use of firewalls, 


with the most typical setup being public and private networks on either side. 


. C. Honeypots are configured identically to a legitimate counterpart such as a web 


server. When the honeypot is placed near the real web server, it should be subject to 
the same type of good and bad traffic that the real server would. Because the honeypot 
has no reason to have legitimate traffic on it, any activity would indicate that 
something malicious is occurring. 


D. Ports 161 and 162 are used by SNMP and can be verified via a banner grab if the 


service is running and present. 


. C. Port 80 is associated with HTTP and will usually allow traffic to pass through 


firewalls unimpeded. 


. C. A bastion host is a hardened dedicated system that traffic is filtered through prior to 


entering or exiting the network. 


. C.A packet-filtering firewall works at Layer 3 of the OSI model. 


9. C. Stateful inspection firewalls analyze the status of traffic. 


o. A. An IP address will in some cases allow a website to be accessed through a firewall, 


whereas a URL would not. 


Chapter 18: Cloud Technologies and Security 


1. 


C. SaaS, or Software as a Service, is an environment used to host software services 
offsite and possibly license just what a company needs and only for as long as they 
need it. 


. B. Drive encryption or its equivalent would be useful in protecting data stored in the 


cloud. 


. B. SOAP is used to enable protocol-independent communication between applications. 


4. C. Man-in-the-middle attacks are effective at altering data in transit between 


applications and the cloud. 


. D. If an NIDS is employed within a cloud environment, attacks such as altering 


checksums of a packet can be used to avoid detection. 


. A, B, D. Cloud technologies can be used for many reasons, but legal responsibility 


cannot ever be transferred to a third party. 


. D. There is no officially recognized environment referred to as LaaS. 


. B. SaaS is the platform type that hosts email services as well as security services in 


most cases. 


. C. The client who pays the cloud service provider to host their data still has legal 


responsibility for its safety. 


. A. You would not create a private cloud to reduce costs as most likely it would increase 


costs due to the need to acquire and maintain expensive hardware and software. 


. B. Three forms of cloud-hosting environments are currently recognized: Saas, PaaS, 


and IaaS. 


. A. Email would be a prime example of SaaS as would hosting office suites and other 


types of software. 


3. A. Cloud-based firewalls are used to separate networks with different security ratings. 


4. D. Platform as a service is ideally suited for development and deployment of custom 


applications. 


. A, B, D. Forensics would not be easier in the cloud; in fact, it may be harder if not 


impossible to perform. 


. B. Even though it would be a cloud based solution, the same ports would be used for 


common services and endpoints. 


. C. A bastion host is used as a choke point. 


. C, D. Since one of the goals of a cloud based solution is to abstract the hardware from 


the client, Layers 3 and above would likely be the only layers that the user would 
interact with. 


.g. C. A firewall with stateful inspection analyzes the status of traffic. 


'0. A. An IP address can be used instead of a URL to evade some firewalls. Much like 
standard web applications, ones based in the cloud could still be exploited in the same 
way. 


Chapter 19: Physical Security 


1. 


C. Tailgating is an attack where an intruder follows an approved individual into a 
facility. Devices such as mantraps can thwart this attack. 


. B. Alarms are a detective control in that they can detect and react to an action but not 


prevent an intrusion. 


. C. A fence should be at least 8 feet tall to deter a determined intruder from entering a 


facility. 


4. C. A bollard is a barrier that prevents cars and trucks from passing it to enter a facility. 


5. A. Liability is a huge issue for dogs and security considering the fact that they may 


attack and cannot discern attackers without human intervention. 


. D. Mantraps are intended to control access and thus stop the occurrence of physical 


breaches as a result of piggybacking and tailgating. 


. B.A false wall is one that extends only to a drop ceiling and not to the actual ceiling. 


These types of walls can easily be climbed over to allow access to a previously 
inaccessible room. 


. A. Defense in depth provides much better protection than a single layer. It also 


provides a means to slow down and frustrate an attacker. 


. B. Bollards can be used with fences to block a vehicle from crashing through a fence 


and making an easy-to-use entrance. 


. A. Atype 2 error is also known as a false rejection error, where someone who should 


have had access was denied it. 


. B. Fingerprint systems are becoming more common on laptops and portable devices. 


They can also be used to authenticate individuals for access to facilities. 


. D. Audio and visual components are both vital. 


. D. Apick and a tension wrench are the minimum equipment included in a lock-pick 


kit. 


. A. A publicly available phone number is not a security risk in many cases because the 


machine may be one that can be sent information from anywhere. 


. A. Adrop ceiling is a false ceiling. 
. B. Portals are more commonly referred to by the term mantrap. 


. C. Acipher lock is a form of combination lock that requires a code to be entered in 


order to open the door. 


. A. Fences in many cases are the first line of defense that an intruder would encounter. 


. C. Encryption of an entire drive dilutes the value of the data if the drive is subject to 


theft; however, it will not keep the drive from being physically stolen. 


‘Oo. B. Flash drives offer several advantages, including their size, speed, and portability. A 
disadvantage for security personnel is that they can hold a lot of data and be very 
easily hidden. 


Appendix B 
Penetration Testing Frameworks 





There are many ways to carry out and complete a penetration test, 
with seh offering its own benefits as well as disadvantages that need to be considered. 
But before we get into that, let’s look at the overall process of a penetration test and then 
we'll cover and explain the finer points. 


Penetration testing typically kicks off with an extensive and thorough scoping and 
planning of the project. The process of planning focuses on determining the overall goals 
of testing and how it will be executed when it takes place. Once this planning is 
completed, contracts are signed, and permissions are obtained, the test can proceed, 
usually starting with the gaining of information that can be used for network scanning 
and later more aggressive actions. When all the penetration testing is complete and 
information about vulnerabilities and exploits has been obtained, a report of some sort is 
typically generated. The report should clearly document all the actions that took place, as 
well as the results, interpretations, and recommendations where appropriate. 


A 


vet This appendix does not cover material that is specifically on the CEH 


credential. Rather, it is included here to provide you practical knowledge of other 
approaches to penetration testing. When you read this appendix, keep in mind that 
while the CEH demonstrates different skills and practices, it is not the only way to do 
things. What’s presented here is an alternative framework that accomplishes the 
same thing as the EC-Council’s process but does so in a different way. 


Always be prepared as a pentester to adapt to different situations or requirements; no 
two pen tests are ever the same, and thus you cannot approach them all the same 
way. 





Overview of Alternative Methods 


Now that you have an idea of what penetration testing is, we need to take a close look at 
the process that a penetration tester follows outside of what the EC-Council offers. 


When you are considering a methodology to follow, you must remember some points and 
ideas up front. 


First of all, remember that a penetration test is considered part of a normal IT security 
risk management process that may be driven by internal or external requirements as the 
individual situation merits. Whether an internal or external risk assessment, it is 
important to remember that a penetration test is only one component in evaluating an 
environment’s security, but it is frequently the most important part because it can 
provide real evidence of security problems. The test should be part of a comprehensive 
review of the security of the organization. 


Items you should expect to test during a penetration test include the following: 
e Applications 


IT infrastructure 


Network devices 


Communication links 


Physical security and measures 


Psychological issues 
e Policy issues 


Before we get too far, let’s take another look at our penetration tests from Chapter 1, 
namely, black box, gray box, and white box. 


Black-Box Testing Black-box testing is a type of test that most closely emulates an 
outside attack and is known as an external test in some circles. The pentester will execute 
the test from a remote location much like a real attacker. The tester will be extremely 
limited in their information and will typically have only the name of a company to go on 
with little else. By using many of the techniques mentioned in this book, the attacker will 
gain information about the target to make their eventual penetration into the company. 
Along the way, the attacker will log and track the vulnerabilities on a system and report 
these back to the client in the test documentation. The pentester will also attempt to use 
their knowledge to quantify the impact any loss would have to an organization. Once the 
test process is completed, a report is generated with all the necessary information 
regarding the target security assessment, categorizing and translating the identified risks 
into a business context (also known as a risk mitigation plan). 


Gray-Box Testing In this type of test the attacker is given limited knowledge that may 
amount to all the information in a black box plus operating system or other data. It is not 
unheard of for this type of test to provide the attacker with information on some critical 
but untouchable resources ahead of time. The idea with this practice is that if the tester 
has knowledge of some key resources ahead of time, they will look for or target these 
resources. However, once one of these targets is found, the tester is told to stop the test 
and report their findings to the client. 


White-Box Testing A white-box test gives the testing party full knowledge of the 
structure and makeup of the target environment; thus, this type of test is also sometimes 
known as an internal test. This type of test allows for closer and more in-depth analysis 
than a black or gray box would. White-box tests are commonly performed by internal 
teams as a means for them to detect problems and fix them before any external party 
locates and exploits them. The time and cost required to find and resolve the security 
vulnerabilities is less than with the black-box approach. 


Now that we are expanding our horizons to look at different methodologies that can be 
used to perform a test, we can add to the list of tests that can be executed: 


Blind Blind testing does not require any prior knowledge about the target system, but the 
target is informed before the execution of an audit. Ethical hacking and wargaming are 
examples of blind testing. 


Double Blind In double-blind testing, an auditor does not require any knowledge about 
the target system, nor is the target informed except for key individuals as defined by the 
client before the test execution. Black-box auditing and penetration testing are examples 
of double-blind testing. Most of the security assessments today are carried out using this 
strategy, thus putting a real challenge on auditors to select the best of breed tools and 
techniques in order to achieve their goal. 


Tandem In tandem testing, the auditor has minimum knowledge of the target system 
before the test, and the target is notified before the test is executed. Crystal box and in- 
house audits are examples of tandem testing. 


Reversal In reversal testing, an auditor has full knowledge about the target system 
before the test, and the target is not informed as to how and when the test will be 
conducted. Red-teaming is an example of reversal testing. 


Penetration Testing Execution Standard 


One of the popular standards for performing penetration testing is the Penetration 
Testing Execution Standard (PTES). This standard was designed by several experts in the 
penetration testing industry. It lays out the format and steps for a test to be performed in 
a consistent, thorough, and reliable way. It consists of seven phases that can be adapted to 
any environment and to any circumstances that may be put in front of you by the client. 


rat The seven stages of PTES detailed by this standard can be found at www 
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.pentest-standard.org and can be explored deeper. The seven phases as defined by the 
PTES are as follows: 


e Pre-engagement interactions 
e Intelligence gathering 

e Threat modeling 

e Vulnerability analysis 

e Exploitation 


e Post-exploitation 





e Reporting 


These phases are designed to cover everything that should happen during a penetration 
test from the very beginning all the way through the final reporting phase. 


The PTES standard is still fairly new but is being updated as requirements and 
technologies change. However, don’t think that because it is new it is not established and 
ready to use. In fact, the guidelines were put through testing in real environments for 
more than a year before they were published. Future versions are planned to contain 
more information on how to manage the penetration-testing project and allocate 
resources to get the test performed correctly and accurately. 


Working with PTES 


So now that we have fleshed out what penetration testing is and the different types of 
tests, we need to discuss the steps involved in a test. It is important for you to be aware of 
what goes into a test and understand the significance of each step in PTES. While no two 
tests will ever be the same, PTES will still apply in just about every case without any 
major revisions to the process. 


vat Remember, one of the primary functions of having a framework such as 
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PTES is to ensure consistency and compliance to potential standards. PTES was 


developed by experts to ensure that these standards are met during a test. You need 
to make sure that you perform each step completely and in a manner that gets 
results. 





Pre-Engagement Interactions 


We've all heard the saying that you have to plan for success; that’s true with any 


penetration test you are tasked with performing. In order to ensure success, you’ll need to 
do a great deal of planning to guarantee an outcome that the client will be satisfied with 
and know that their goals are being met. 


To start the process, a kickoff or scoping meeting will normally take place to discuss the 
course of the test. Expect the meeting to cover many different issues, but specifically look 
for information relating to scope, objective, and parties involved. Before the meeting is 
finished, you must have a clear idea of the scope of the test; without it, the test cannot be 
effective and it would be difficult if not impossible to determine if you’ve reached a 
satisfactory outcome. Primarily, the scope should focus on uncovering and determining 
the extent of vulnerabilities on the target network. The scope should also determine what 
is and isn’t included in the test; essentially you are looking to establish boundaries that 
you will be required to stay within. 


vat Always make sure that you have a list of questions that you need 


A 


answered in order to guide your test to the proper conclusion. It’s best to have these 
questions prepared in advance to ask when you talk to the client. These questions 
should be asked during the initial meeting. 





Here are some questions to consider: 
e Why is a penetration test necessary? 
e What is the function or mission of the organization to be tested? 
e What will be the constraints or rules of engagement for the test? 
e What data and services will be included as part of the test? 
e Who is the data owner? 
e What results are expected at the conclusion of the test? 
e What will be done with the results when presented? 
e What is the budget? 
e What are the expected costs of the test? 
e What resources will be made available? 
e What actions will be allowed as part of the test? 
e When will the test be performed? 
e Will insiders be notified? 
e Will the test be performed as a black or white box? 


e What conditions will determine the success of the test? 


e Who will be the emergency contacts? 


Since many things can be made part of a test, and whether they’re included or not will 
depend on the company’s motives, you should make sure the client is aware of the 
options and if certain tests may be required. You can use one or more of the following 
categories to obtain the results a client is seeking. Make sure the client approves each 
category you decide to use. 


Social Engineering The weakest element in just about any system is the human 
element. Technology is available to assist and strengthen the human component, but a 
large number of the weaknesses present must still be addressed through training and 
practice, which are sorely lacking in many companies. Testing the security of an 
organization via its human element should be considered for every potential penetration 
test. 


Application Security Testing This form of test focuses specifically on locating and 
identifying the nature of flaws in software applications. This type of test can be performed 
as an independent test or as part of a complete testing suite. This process may be 
requested in those situations where custom applications or environments exist and a 
closer scrutiny is required. 


Physical Penetration Test Strong physical security methods are applied to protect 
sensitive data. This is generally useful in military and government facilities. All physical 
network devices and access points are tested for possibilities of any security breach. This 
test may seek to gather information from devices or other assets that are unsecured; it 
can be considered as part of a social engineering test in some situations. 


Insider Attack This is intended to imitate the behaviors that an internal party who 
already has authorized access to a system may perform. 


Outsider Attack This is intended to imitate the actions and attacks that would be 
undertaken by an outside party. 


Stolen Equipment Attack This is a type of attack whereby an aggressor steals a piece 
of equipment and uses it to gain access or extracts the information desired from the 
equipment itself. 


Another item to discuss and refine during the meeting is the timing and overall duration 
of the test. This is an extremely important detail because some clients may want you to 
conduct the test only during specific hours to avoid disruption to their infrastructure and 
business processes. You'll need to balance this requirement against the need to evaluate 
an organization as it works or is under stress, which an after-hours test will not provide. 
No organization is willing to have their operations affected as the result of a penetration 
test, so performing aggressive tests such as a denial of service may be frowned upon. Just 
be aware of any limitations, and if you need to deviate from them check with the client. 
Ensure that you receive amnesty in the event that your team disrupts operations during 
the testing, by having the data owner or sponsor acknowledge that they are willing to 
accept that risk. 


Another decision to make during this meeting is who will and who won’t be informed 
about the test. Some part of the staff will always be aware of the test and will be on hand 
to verify that you are supporting the goals of the organization but also to provide support 
in the event that you are confronted about performing the test by those who don’t know 
about it. Informing too many staff members can have the effect of doctoring the results 
because personnel will adjust their work habits either consciously or unconsciously when 
they know a test is ongoing. 


Contents of a Contract 


When the initial meeting is conducted, a contract will be generated outlining the 
objectives and parameters of the test. Let me give you a rough idea of some of the items 
that may be included: 


Systems to Be Evaluated or Targets of Evaluation The client and penetration tester 
will work together to determine which systems require evaluation during the penetration 
test. This evaluation can be limited to those of higher value to the organization or those 
that need to be tested for compliance reasons. 


Perceived Risks In any penetration test, some unplanned event can and will happen. 
Despite your best-laid plans and preparations, the unexpected will occur, and by 
informing the client of the likelihood ahead of time you decrease the surprise of 
downtime and allow for preparations for lessening any impact. 


Timeframe Set a realistic timeframe during which the tests are to be conducted. Ensure 
that enough time is allocated to perform the test, check and verify the results, and catch 
any problems. Set specific times of the day and week to perform the test because results 
and responses to an attack will vary depending on time of day and which day it is 
performed. 


System Knowledge You don’t need extensive knowledge of the systems you're testing, 
but you should have some level of understanding and comprehension about them. 


Actions to Be Performed When a Serious Problem Is Discovered Don’t stop after 
you find one security hole. Ensure that you document your findings using the five Ws. A 
pen test team that is operating 24 hours a day will need to keep a log in order to meet 
customer requirements as well as any regulations that apply. Keep going to see what else 
may possibly be discovered. If you haven’t found any vulnerabilities, you haven’t looked 
hard enough. If you uncover something big, you do need to share that information with 
the key players as soon as possible to plug the hole before it’s exploited. 


Deliverables These include vulnerability scanner reports and a higher-level report 
outlining the important vulnerabilities to address, along with countermeasures to 
implement. 


Gaining Permission 


Remember one of the key tenets of performing a penetration test on an organization is to 


get clear and unambiguous permission to conduct the test. While getting sponsorship and 
such to perform the test is important, it’s vital to document permission. Get the person 
authorizing the test to formally sign off on the project and the plan, and have their 
contact information on hand just in case. Without such authorization, the test can run 
into one of many snags, including that the test was never authorized, which could easily 
lead to lawsuits against you as the pentester. 


So what form can this authorization take? Verbal authorization is not desirable, but 
documentation showing that authorization was granted is acceptable. A test should never 
proceed with just verbal authorization. If you are an outside contractor, a signed contract 
is enough to convey and enforce permission for the action. Internal tests can be justified 
with an email, signed paperwork, or both. 


Without this paperwork or permission in place, it would be unwise and possibly illegal to 
proceed. The permission not only gives you authorization to conduct the test but also 
serves as your “Get out of jail free” card if you are challenged as to whether you should be 
testing or not. 


Don’t ever underestimate the importance of having permission to do a test as well as 
having it in writing. Charges have been filed and successfully pursued against those who 
have not had such permission or documentation. 


A 


rao Never take getting permission for granted. When a client engages you for 


a test, ensure that permission is given in writing as part of the paperwork that is 


completed prior to starting. Even more important, if the client requests that 
additional tasks be performed, you need to make sure that your current permission 
paperwork covers the change; if not, get an amended agreement prior to adapting to 
the changing test conditions. 





Intelligence Gathering 


Once a plan is in place and proper preparation has been completed, you can begin the 
information-gathering process. This phase represents the start of the actual test, even 
though you will not yet be engaging your target directly. However, at this step you can 
obtain a wealth of information. 


In the EC-Council model this step is known as footprinting. In any case, 


the process is intended to be methodical and careful. A careless or haphazard process 


of collecting information in this step can lead to a waste of time later when moving 
forward or in a worst-case scenario the outright failure of an attack. The smart and 
careful tester will spend a good amount of time in this phase gathering and 
confirming information. 





How do you gain information in PTES? There is an endless sea of resources available to 
do this, and it is up to you to determine which are useful and which are not. Look for 
ways to gain information that will help you build a picture of a target that will allow you 
to refine later attacks. Information can come from anywhere, including search engines, 
financial disclosures, websites, job sites, and even social engineering. Where PTES differs 
from the EC-Council model is that it includes three levels of information gathering, each 
more aggressive than the previous one: 


e Level 1 is basic information gathering, which is essentially a cursory look with 
automated tools to see what you can find out from simple sources. 


e Level 2 is executing the information-gathering process by using automated and 
manual tools to gain a much better understanding of the target. For example, now you 
are trying to understand the functioning of a business as well as other information, 
including physical data regarding the business such as location. 


e Level 3 is the most aggressive and complete level but also the most time and resource 
intensive. At this level, typically teams of penetration testers are involved to find out 
intimate details about the target. 


ret In some organizations teams of pentesters are assembled into what is 
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known as a red team. These teams work together to simulate a much more 
sophisticated level of attack. In some cases these red teams take on not just the goal 
of assessing security but also the mannerisms and goals of a hostile party, such as an 
unfriendly foreign government or terrorist cell. 





Before you start gathering information, you need to do some groundwork for the process 
in order to make the phase more focused and effective: 


e First, define what the target actually is. This should be straightforward if you have had 
thorough discussions with the client. But this is another chance for you to make sure 
that you fully understand what you are supposed to be targeting and have the correct 
information. 


e Second, consider any rules of engagement that may have been put in place by the 
client. Ensure that you understand the limits of what the client wishes you to do and 


that your activities will stay within those limits. 


e Third, define the time length for the test and what you can accomplish within that 
timeframe. 


e Fourth, and this is extremely important, determine the goal of the test. Make sure you 
have a clear goal from the client, and that you are pursuing activities that will get you 
to that goal. 


What you want to have when leaving this phase is a comprehensive list of information 
that can be put to use later: 


Public Information Information that may be publically available about a target would 
include host and network information. 


OSINT Open-source intelligence is a vital part of the process and typically gets 
information from public sources. The drawback is that this information may be somewhat 
out of date. 


Sector-Specific Data Ascertain the operating system or systems in use in a particular 
environment, including web server and web application data where possible. 


Network Information Find network information via queries such as Whois, DNS, 
network, and organizational queries. 


System Weaknesses Locate existing or potential vulnerabilities or exploits in the 
current infrastructure that may be conducive to launching later attacks. 


HUMINT This term is shorthand for human intelligence, which sounds cool but it is just 
another way of saying social engineering (it does sound cooler though). 


The process of gathering information in PTES is very detailed concerning the types of 
items you can attempt to gather to make later steps easier. The guidelines pertain to not 
only technical information but physical and other information as well. 


The manner in which PTES defines how to collect information and the types of 
information collected bears some resemblance to the EC-Council’s standard, but it is not 
100 percent the same. The process is different in that it defines different levels of 
information gathering and the details you should expect to get. It’s the same in that it 
gathers much of the same information that can be obtained through the same means we 
discussed in Chapter 4, “Footprinting.” 


Threat Modeling 


The threat-modeling phase is not included in the EC-Council process. In the EC-Council 
model threat modeling is included in the early footprinting step. PTES includes it as its 
own step and dedicates more time and effort to the process. 


Threat modeling is the process of defining assets and the possible attacks that they may 
face. The threat model tries to break down assets or individual components of an 
application to better quantify what is being threatened. Once things are diagrammed and 


defined, you have a clearer picture of what needs to be assessed and have more guidance 
as to how to proceed. 


The threat-modeling process concentrates on gaining information in four key ways: 
e Gather relevant documentation. 
e Identify and categorize primary and secondary assets. 
e Identify and categorize threats and threat communities. 
e Map threat communities against primary and secondary assets. 


In many ways this process is almost like an in-depth footprinting process with greater 
attention to detail. You should expect to draw on just about everything you gathered from 
that step—everything from technical data and business process information to employee 
and location information and much more. 


You will also during this phase do some research to ascertain the threats that are likely to 
impact the assets. Fortunately, as you learned in our early chapters, there are many 
databases, websites, and brainpower available to fill in the gaps in your knowledge of 
threats if needed. 


Once you have an accurate model and an idea of what the threats are, you can move on to 
the next step. 


Vulnerability Analysis 


Now things are heating up as you move into the vulnerability analysis phase. Here you 
examine your target by more actively engaging them with various tools of your choice. 
Flaws can literally be anything from misconfiguration issues to defects in software and 
design. While you could look for countless numbers of vulnerabilities in an environment, 
the previous phase would have helped you narrow your analysis to specific items. 


When performing this phase you need to make sure that your test has a clearly defined 
scope and goals (fortunately, you did that in a previous phase). With your scope, goals, 
and depth in mind, you can then choose tools appropriate for the job. 


J Ss = Something to keep in mind regarding the scope and depth aspect of testing 


is just how important defining both really is. Depth in particular is very important to 
keep clear. When you assess a host or anything else as part of your test, you can 
spend countless hours digging deeper and deeper. In other words you can keep 
drilling deeper looking for vulnerabilities, but at what point are you wasting time 
rather than being productive? That’s where your early pre-engagement discussions 
should help because you should already have information on goals and scope to 
guide you. 





What exactly happens during the vulnerability analysis phase? This phase more or less 
corresponds to the scanning and enumeration steps from the EC-Council’s model. This 
means you are doing port scans, banner grabs, OS fingerprinting, vulnerability scans, and 
all of the rest of the tasks we covered during those steps. 


What you don’t do during this phase is start the process of penetrating any deeper. 
Remember, you are still gathering information, though more actively, about your target 
that you can act on or that will at least influence your next set of actions. 


That brings us to our next phase of the PTES process, exploitation. 


Exploitation 


Once a target has been scanned and openings and vulnerabilities determined, the actual 
penetration of the target can proceed. This step is intended to exploit weaknesses found 
in the system with the intention of compromising the system and gaining some level of 
access. 


The penetration tester should expect to take the results from the previous step to 
carefully consider and identify a suitable target for penetration. Keep in mind that during 
the previous step you may uncover a good number of vulnerable systems, and the 
challenge is now to locate a system or systems that can be exploited or are valuable 
targets. For example, when scanning a network the tester may locate a hundred systems, 
but of this number only four are servers, with the rest being desktop systems. While the 
desktop systems may be interesting targets, the tester will probably focus their attention, 
at least initially, on the servers, with desktops being a possible secondary target. 


After selecting suitable or likely targets, the tester will attempt to use their skills and 
knowledge to break into the targets. Many different attacks may be tried before one is 
actually successful, if any at all. Remember that scanning a system and assessing it as 
having a vulnerability does not mean it is actually capable of being exploited. The tester 
should consider which type of attacks may be successful and the order in which to 
attempt them prior to actually employing them against a target. 


Attacks that may be possible during this phase can include the following: 
e Password cracking 
e Traffic sniffing 
e Session hijacking 
e Brute-force attacks 
e Man-in-the-middle attacks 


All of these attacks and more have been covered in this book, and you would apply those 
attacks in this phase. Also keep in mind that the attacks used here are not just for 
technical components; they include the physical and human components as well. If an 
attack you have learned about is within the scope of the test and fits the rules of 


engagement, you should use it. 


Once you have established a stable connection to the internals of a host or something else 
in the environment, the next step awaits you. 


Post-Exploitation 


Now that you are in the system, the first thing you must do is maintain that access. 
Maintaining access preserves the opening that you made into a system as a result of what 
you did during the exploitation phase. This step also assumes that you want to press the 
attack further or come back later to perform additional actions. 


This phase starts with taking stock of what you have gained access to. Is the asset that 
you have compromised something of value as it is, or do you need to do more? Typically, 
the system you have compromised will require some further actions on your part, such as 
escalating privileges, gaining further access, and looking for useful data or other valuable 
information. 


So what could you do at this point if you don’t find anything of immediate value on the 
system? The answer is plenty. You could plant a keylogger on the system with the goal of 
capturing keystrokes and perhaps passwords or similar information. You could locate 
encryption keys on the system and take control of them. You could even use this time to 
plant a backdoor on the system and cover your tracks to avoid detection. 


However, one of the most valuable moves you may be able to carry out at this point is 
pivoting. Pivoting is the process of using the compromised system as a beachhead from 
which you can penetrate deeper into the environment by performing actions such as 
scanning ports, sniffing traffic, enumerating services, and much more. 


D Real World Scenario 
Which Way Is Best? 


It is important to discuss automated versus manual penetration testing because you 
will encounter both and may not initially be able to distinguish one from the other. 
So let’s look at both and hopefully prevent any confusion before it occurs. 


Automated tools can be used to identify many of the more common, well-known 
weaknesses that may be present in an environment. These tools typically have 
regular updates that ensure that the latest weaknesses are caught. 


Here are some guidelines for selecting a good penetration tool: 
e It should be easy to deploy, configure, and use. 
It should scan your system easily. 


It should categorize vulnerabilities based on severity and determine which ones 
need an immediate fix. 


It should be able to automate verification of vulnerabilities. 
It should verify exploits found previously. 
e It should generate detailed vulnerability reports and logs. 


However, automated tools have some limitations such as producing false positives, 
missing known weaknesses, or even giving a false sense of confidence in the results. 


Since automated tools cannot locate every potential weakness, the need for manual 
testing becomes apparent. A human, with the right training and knowledge, can 
locate a wide range of weaknesses that may not be located through automated 
means. However, the downside of performing the test manually is that it is time 
consuming and it is just not possible for a human being to check every potential 
vulnerability in a reasonable amount of time. 


So what is the best approach? The best approach for many penetration testers is to 
combine the two into a hybrid approach, with the automated tests looking for 
vulnerabilities and the manual ones focusing on specific issues or doing further 
investigation on specific weaknesses. 





Reporting 


After conducting all the tasks discussed previously, your next task is to generate a report 
for the client. While the report can take many different forms depending on the specific 
situation and client needs, it must include some essential pieces of information in a 
specific format. 


The report should start with a brief overview of the penetration-testing process. This 
overview should seek to neatly encapsulate what occurred during the test without going 
into too many technical details. This section will be followed by an analysis of what 
vulnerabilities were uncovered during the test. Vulnerabilities should be organized in a 
way that draws attention to their respective severity levels such as critical, important, or 
even low. The better you can separate the vulnerabilities, the more it will assist the client 
in determining where to dedicate time and effort toward addressing each. 


The other contents of the report should be as follows: 
e Summary of any successful penetration scenarios 
e Detailed list of all information gathered during penetration testing 
e Detailed list of all vulnerabilities found 
e Description of all vulnerabilities found 
e Suggestions and techniques to resolve vulnerabilities found 


I additionally try to summarize my reports for clients in a less-technical format up front. I 
then attach the hard technical data as an appendix to the report for the client to review as 
needed. 


D Real World Scenario 
External Factors and Reports 


In some cases clients may request a certain format either directly or indirectly as a 
condition of the test they request. For example, in tests that are performed in order 
to satisfy payment card industry standards, a client may request a format that 
conforms to specific standards. The same might be said for requirements pertaining 
to HIPAA standards and others. Always ask your client if any specific format is 
needed or if it is up to your discretion. 





In order to make the reporting and documentation process easier, I strongly reeommend 
that during your process of penetration testing you make a concerted effort to maintain 
good, clear, and consistent notes. If this is not your forte, I strongly advise that you 
develop these skills along with purchasing or developing a good reporting system to ease 
some of the load of this process. A lack of documentation can not only make things 
harder for you; it can also leave conspicuous holes in your test data. 


Mopping Up 


This last piece is not part of the EC-Council or PTES process, but I think cleaning up 
needs to be mentioned. After all is said and done, you may have some cleaning up to do as 
a result of the actions taken during the penetration test. As you should have been doing 


all along, go through your documentation to examine all of the actions you took and 
double-check to determine if anything you performed needs to be undone or remediated. 
You are seeking to make sure that no weakened or compromised hosts remain on the 
network that could adversely affect security. In addition, any actions you take to clean up 
the network or hosts should be verified by the organization’s own IT staff to ensure that 
they are satisfactory and correct. In essence, you are making sure that you have left the 
systems the way you found them. Leaving something behind or not documenting what 
occurred and was removed can easily lead to a lawsuit against the pentester. 


Typical cleanup actions include the removal of malware from systems, removal of user 
accounts, and restoration of changed configurations and anything else that may have 
been altered or impacted during the test. 


Simply put, you can’t perform a penetration test, compromise and weaken a system, and 
then call it a day and leave it in that state. Doing so can cause you all sorts of problems 
ranging from leaving a bad impression to potential lawsuits and even career suicide if a 
real malicious compromise happens as a result. 


Summary 


Penetration testing typically kicks off with extensive and thorough scoping and planning 
of the project. The planning process focuses on determining the overall goals of testing 
and how it will be executed. The penetration tester and the client need to carefully and 
thoughtfully consider the goals of a test and ensure that they are realistic and appropriate. 


Once this planning is completed and contracts have been signed and permissions 
obtained, the test can proceed, usually starting with the gaining of information that can 
be used for network scanning and later more aggressive actions. Once all the penetration 
testing is complete and information about vulnerabilities and exploits has been obtained, 
a report of some sort is typically generated. The report should clearly document all the 
actions that took place, the results, interpretations, and recommendations where 
appropriate. 


A penetration tester also needs to be aware of the different laws that may or may not 
impact the test and their own activities. A tester needs to make sure that they are legally 
protected and should consider contracting with outside legal help to ensure both their and 
their client’s needs are met. 


Appendix C 
Building a Lab 





You learned several things in this book that will help you become a 
more onea and skilled hacker. However, the problem is that many of these 
skills require practice and exploration to use, not to mention that if you don’t practice 
them just about all the skills are perishable. With this in mind it’s important to show you 
the items you will need to build your own lab so you can have your own sandbox to play 
in and experiment in without worry. Remember that unless you have permission from 
the owner or own the network yourself, you should not be poking around a network. 
Doing so could potentially end your career and your freedom. So let’s explore how to 
build your own environment for testing. 


P = As a penetration tester you will need to use a wide range of tools and 


techniques to accomplish your job. You will find a seemingly endless array of tools of 
all different types, shapes, and sizes that may or may not be useful in conducting a 
penetration test. With so many tools available, you will have to spend some time 
evaluating the various tools for new options and new versions. I have endeavored to 
include as many tools as I possibly could that are both free and well documented. 
However, a few on this list may have an associated cost to either acquire or develop. 





Why Build a Lab? 


So which tools should you become fluent with or concentrate on when testing or 
training? I have included a list of tools later in this chapter that you should consider 
getting familiar with in order to prepare properly for the test. 


vat This list is a short one, but that does not mean you should stop with what 
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is noted here. You should have at least three to five of each type of tool available just 
in case you don’t get the results you want out of your favorite tool. 





The Build Process 


The first step in setting up a lab is to configure the system that you will use for testing. 
Since this guide assumes you will be using a single system to test your skills and evaluate 
tools, we will be using virtualization as the way to best facilitate this goal. The lab setup 
described here assumes that you will be using Windows as a base operating system with 
virtualized operating systems hosted on top of this environment. If you don’t wish to host 
virtual machines with additional tools in either Windows and Linux, you can skip setting 
up the virtual environment. 


But before you decide against creating a virtual machine, consider the advantages: 


You can test malware without risk because your guest operating system can be 
isolated. 


You can easily test different servers and applications without modifying your base 
operating system. 


In case the virtual machine gets damaged or misconfigured in some way, you can 
reinstall it or roll it back to a previous snapshot. 


You can set restore points or snapshots prior to installing and testing new tools; if 
something goes awry, you can easily revert to an earlier configuration. 


You can host multiple operating systems on one physical machine without configuring 
some complex multiboot setup. 


Configuring a test network or virtual machines is much cheaper and more efficient 
than using actual networking hardware. 


Of course, everything has its downsides, so let me address some of those: 


Some software will not work properly in a virtual environment. 


Some hardware devices used for penetration testing will not work with virtualization, 
although this is becoming less of a problem with newer versions of the technologies 
involved. 


The hardware used to host both the physical operating system and multiple virtual 
machines will need much more memory, and it will need plenty of disk space to host 
everything. 


Sometimes the virtualized networking functionality can be a bit glitchy. 


While neither of these lists is exhaustive, they should at least get you thinking. Neither 
choice (to go virtualized or not) is wrong, and in the field you can find individuals using 
both, but make sure you understand the situation before you implement it and use it in 
production. 


What You Will Need 


In order to build a proper lab you will need to do several things first, some optional and 
others not. I recommend putting down some important foundations first. Make sure you 
have a good understanding of what you are trying to accomplish, and don’t just start 
building at random. But before we get started, let’s look at some of the reasons why you 
would create a lab. 


If you were to search the Internet, you would undoubtedly find countless tutorials and 
guidelines on how to best accomplish the task, each positioning itself as the best solution. 
You know what? They are all right in their own way, so we will focus on what you need to 
test and what you are trying to accomplish, both to study for the CEH exam and to have 
your own sandbox later. 


ret I would love to sit here and write that all other methods of creating a 
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testing lab and sandbox to play in are junk, but that’s simply not the case. Each 
approach has its own merits and drawbacks (including the one I demonstrate here). 
What I have tried to do is describe a system that has the most flexibility and ability to 
test your skills. 





I will discuss one of the more common and useful setups in this appendix so you can 
determine if it is the best option for you, but I will also provide notes along the way as to 
equipment and changes that may be needed to make the process better. 


Creating a Test Setup 


There are many approaches you can take, but if you go with the common one-system, 
self-contained lab setup, you will need to have a few things in place: 


e A laptop or desktop with as much RAM as you can get shoehorned into it; 8 GB is good 
but more is better. 


e A large hard drive to store all the virtual machines plus the host operating system and 
its tools. I do not recommend going under 250 GB if you can afford it, and definitely 
going with an SSD drive if you can find one in your price range. The performance 
increase and extended battery life are invaluable. 


e The host operating system physically running on the system can be Linux, Microsoft 
Windows, or OS X. Which you use is up to your personal preference. 


e Make sure the system you will be using has all patches and corresponding security 
updates and other items installed. 


e For a wired and wireless (802.11, b, g, n and ac support if possible) network, you 
should check to see if your hardware of choice supports monitor mode with respect to 
wireless adapters. If your adapter does not support monitor mode, you will need to get 
an external adapter for any wireless attacks and surveys. 


e Optional: Bluetooth support. For extended range when scanning for and working with 
Bluetooth devices you may want to consider getting an external adapter such as the 
SENA UD100.The SENA adapter not only extends the range of Bluetooth, but it also 
supports Bluetooth packet injection and additional external antennas for even longer- 
range support. 


Since you are using a single system to build and host the lab, you will be using 
virtualization. Virtualization just means that you are going to be hosting multiple 
operating systems upon a software-emulated hardware environment. To do this you will 
need to use virtualization software, and there are plenty such packages to choose from. 
While I am not specifically endorsing the ones mentioned here, these are the ones that 
are the most popular and see the most use. 


Virtualization Software Options 


The virtualization software that tends to be the most popular is varied and depends on the 
goals and preferences of the customer or penetration tester. Let’s look at a few: 


e Oracle VM VirtualBox is one of the most commonly used and popular virtualization 
applications. The software offers multiple-platform support for both 32- and 64-bit 
environments. The program has proven to be very stable, reliable, and easily 
configured with plenty of options. Plus the software is free. 


e VMware Player and VMware Workstation are two other extremely popular options in 
the workplace. First, the products are cross platform, very powerful, and customizable, 
and they have a sizeable user base. The downside is that the Workstation component 
costs money, but the Player is free and will take care of almost everything you need. 


e Microsoft Hyper-V is an extremely popular virtualization product although it is not as 
popular for setting up these types of labs because it tends to use more resources and is 
not cross-platform compatible. 


The Installation Process 


In this section I will try to keep the installation process as generic as possible so it can be 
applied to any operating system, but there may be variations in your own environment. 
On top of this base you will install the virtualization software that will host the guest 
operating systems. 


You should take the following steps prior to installation of your virtualization software of 
choice: 


1. Apply all patches, services packs, drivers, and other updates as required by the 
operating system. 


2. Apply any software updates for the hardware and firmware as required by the vendor 
of your specific hardware. In my case I always check for updates with the Lenovo 


website because my particular system is a Lenovo ThinkPad. 
3. Install an antivirus and antimalware application. 


4. Optional: Install an office suite, which should include a word processing application 
and a spreadsheet application at the very least. In addition, you should consider a suite 
that has a presentation application for when you need to display slides to clients or 
simply document your testing. Choices include Microsoft’s Office suite or LibreOffice. 


5. Optional: Install a PDF viewer. My personal favorite is Sumatra PDF. 
6. Optional: Install a PDF printer application such as Primo PDF. 


7. Install your virtualization software by following the vendor’s instructions. 


Installing a Virtualized Operating System 


The next step in preparing the lab system is to install your virtual machines and configure 
them. Since I do not know which virtualization software you will choose, I will provide 
some broad steps on how the process works. You will need to research the specifics for 
your software of choice. 


In general, the process works something like this: 
1. Create a new virtual machine in your software. 


2. Name the new virtual machine something meaningful, such as Windows 7 64-bit or 
Kali Linux. 


3. Depending on the OS you intend to install on the virtual machine, you will need to 
allocate some memory to the virtual environment. I usually recommend allocating a 
minimum of 2 GB to a VM guest. Keep in mind that these amounts will vary, and most 
software will allow you to increase or decrease this amount later. 


At this point you can install your operating system on the virtual environment. To do this 
you will need either an ISO file or media such as a CD/DVD or USB flash drive. Once you 
have that in hand, follow the instructions in your virtualization software to mount the 
media and perform the installation process. 


Installing Tools 


Once you have configured, patched, and prepared your virtual machine, you can install 
the applications you’ve chosen. This section is meant to help you at least get started with 
the process of locating and evaluating some new tools. 


To prepare for the CEH exam, you should learn how to use the tools listed in the 
following sections. 
Types of Software Tools 


To make things easy I have classified the tools by category, each in no particular order. 


Scanners: 


Nmap You can acquire Nmap at www.nmap.org, which is the website of the developer 
itself. Since this tool is such a flexible and powerful piece of software and is cross 
platform, you should seriously consider making it part of your toolkit. 


Angry IP Scanner Available at www.angryip.org, this piece of software is a simple, 
quick, and dirty way of locating which hosts are up or down on a network. While the 
functionality for this tool can be replicated with a few switches in Nmap, it still may prove 
a good fit for your toolkit. 


SuperScan This tool is available at www.mcafee.com and is useful mostly for 
performing certain steps during the enumeration phase. However, this tool is a port 
scanner as well. 


Zanti (for Mobile Phones) This app is available on Google Play, where it can be 
downloaded for free. 


Zenmap (Part of Nmap) Included as part of the Nmap package, it is nothing more than 
a graphical front end to the command-line Nmap scanner. 


NBTScan This is used for NetBIOS scans and can be downloaded from www.sectools 
.Org. 


Hping2/hping3 These packet-crafting utilities can be used to create custom scans or 
probe individual ports with precision. They can be obtained at www.hping.org. 


NetScan Tools This multipurpose suite of tools is available at www.netscantools.com. 
Enumeration: 


DumpSec This is available from www.systemtools.org and can be used as a means to 
reveal the users, groups, printers, and other information from a targeted system. 


SuperScan This tool can be found at www.mcafee.com and is useful mostly for 
performing certain steps during the enumeration phase. However, this tool is at heart a 
port scanner as well. 


Netcat This is a multipurpose tool that can be used to perform enumeration. You can 
obtain it at www.sectools.org. 


Cryptcat It’s the same as Netcat except it offers encryption capabilities that Netcat 
cannot. It’s useful when trying to avoid sniffing or detection by an IDS and can be 
obtained at www.sourceforge.net. 


TCPView This is used to view connections to and from a given system and can be 
obtained at www.microsoft.com. 


Sysinternals Suite This collection of tools can be obtained at www.microsoft.com. 


NirSoft Suite This collection of various useful tools and utilities can be obtained at 
www.nirsoft.net. 


Password-Cracking Tools: 

LophtCrack This tool can be obtained from www.lophtcrack.com. 
Ophcrack You can obtain this tool from www.sourceforge.net. 
John the Ripper Find this tool at www.openwall.com/john. 


Trinity Rescue Kit Here’s another multipurpose tool that’s useful for performing 
password resets on a local computer. It can be downloaded from www.trinityhome.org. 


Medusa This is an old password cracker from www.sectools.org, but it still may work 
when other crackers fail. 


RainbowCrack Available at http://project-rainbowcrack.com/, it cracks hashes with 
rainbow tables. 


Brutus Available at www.sectools.org, this is an old but still somewhat effective web 
application password cracker. 


Sniffers: 


Wireshark Available at www.wireshark.org, this is the most popular packet sniffer in the 
IT industry. It’s a fully customizable packet sniffer with plenty of documentation and help 
both online and in print. Wireshark boasts cross-platform support and consistency across 
platforms. 


Tepdump Available at www.tcpdump.org, this is a popular command-line sniffer 
available for both the Unix and Linux platforms. 


Windunpp Available at www.winpcap.org, this is a version of tcpdump but ported to the 
Windows platform. 


Cain & Abel Available at www.oxid.it, this multipurpose tool includes basic sniffing 
capabilities among other functions designed to recover passwords. 


Kismet (for Wireless) Available at www.kismetwireless.net, this is a popular wireless 
sniffing and detection tool designed for the Linux operating system. 


Ntop Available at www.ntop.org, this is a high-speed sniffer designed for Unix systems. 


NetworkMiner Available at www.netresec.com, this network sniffer is capable of 
capturing traffic and doing analysis but also is capable of performing forensically accepted 
analysis. 


Wireless Tools: 


Kismet Available at www.kismetwireless.net, this is a popular wireless sniffing and 
detection tool designed for the Linux operating system. 


inSSIDer Available at www.metageek.com, this is a network detection and location tool. 


Reaver Available at https://code.google.com/p/reaver-wps/, this tool is used to perform 


brute-force attacks against WPS-enabled routers. 


Netstumbler (Old but Useful on 32-Bit Systems) This offering from 
www.netstumbler.com works much like MetaGeek’s offering but is not as feature rich. 


Bluesnarfer You can obtain this tool from the repositories of any Linux distribution. 


Aircrack-ng Available at www.aircrack-ng.org, this is a suite of tools used to target and 
assess wireless networks. 


Logging and Event-Viewing Tools: 


LogParserLizard Available at www.lizard-labs.com, this tool is used to analyze log files 
and allows for the creation of queries to reveal events from Event Viewer and other logs 
such as IIS and FTP. 


ret I want to point out that if you use Kali Linux 2.0, which was released on 
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August 11, 2015, the product includes a full suite of tools to do all of the tasks we 
covered in this book as well as others we haven’t covered. If you are going to use Kali 
Linux, I highly recommend that you update your distribution regularly. 





Types of Hardware Tools 


So which hardware-based tools should you become fluent with or concentrate on when 
testing or training? Becoming familiar with the following tools should help you prepare 
for the CEH exam. 


Minipwner Available at www.minipwner.com, this multipurpose tool is about the size of 
a deck of cards. The device allows for the sniffing of both wired and wireless network 
traffic. Since it has a battery, it can be plugged into a client’s network and left behind 
while you gather information remotely. Because it also acts as wireless access point (fully 
configurable), it can also perform numerous wireless attacks. 


USB Rubber Ducky Available at www.hak5.org, this is a flash drive—sized device that 
can be plugged into a system to run scripts for any purpose. The advantage of this device 
is that it appears as a keyboard rather than a flash drive, meaning there is little chance of 
it being detected or stopped by enterprise security policy. 


Wi-Fi Pineapple Also available at www.hak5.org, this is a much-talked-about Wi-Fi 
honeypot and wireless tool. It can be used to perform many of the same tasks as the 
minipwner. 


LAN Turtle Also available at www.hak5.org, this is a powerful tool for sniffing, 
capturing, remote accessing, and other capabilities all packaged inside a seemingly 
innocent Ethernet adapter. 


AirPcap Available at www.riverbed.com, this is a USB dongle used to allow more in- 
depth analysis of wireless traffic. It can be very pricey, however, so I would recommend 
keeping an eye on eBay to see if you can get a used one at a lower cost. 


Ubertooth One Available at www.greatscottgadgets.com, this hardware device allows for 
the analysis and detection of Bluetooth devices. 


Raspberry Pi Available at www.raspberrypi.org, this is a minicomputer about the size of 
a pack of cards. The benefit of this device is that it can be readily adapted to a number of 
different situations and has been used to build everything from mini-supercomputers to 
arcade machines and pen-testing devices. The device runs about $35 in most cases. 


Pwn Pad Available at www.pwnieexpress.com, this one is very pricey, but I felt I should 
include it here just for your review and information. The Pwn Pad is a tablet device that 
comes preset and configured with its own operating system and embedded tools for 
penetration testing. It can perform all sorts of wireless and Bluetooth hacking as well as 
password cracking and web application hacking. While the price tag may keep the device 
out of the hands of many, it can be obtained on a much tighter budget if you search out 
the Pwn Pad community edition and follow the instructions to make one yourself. 
Instructions can be found on the pwnieexpress.com website. 


Pwn Phone Also available at www.pwnieexpress.com, this is essentially the same as 
their Pwn Pad but shrunk down even more to the size of a smartphone. 


Yagi Antenna You can obtain this tool from many sources. Check sites like eBay or 
Amazon.com for prices. 


Parabolic Antenna Much like the Yagi, this can be purchased from any number of 
sources online. 


KeyGrabber Available at www.keelog.com, this is a hardware-based keylogger that plugs 
into USB ports on a system. 


Tablet This last one is my personal suggestion and one that I use in my personal life. I 
use a tablet to keep many of my reference guides and books close at hand. Thanks to 
Amazon’s Kindle, I can keep a multitude of books with me without breaking my back in 
the process. My personal choice is an Android-based tablet from Lenovo, but you should 
use the one you prefer. A final reason for using a tablet is that it also reduces the battery 
usage on my notebook when I have to read a simple manual or book. 


Summary 


As a penetration tester you will need to use a wide range of tools and techniques to 
accomplish your job. The variety of software and hardware-based tools make a complete 
penetration-testing kit. You must, as a successful penetration tester, be ready to evaluate 
and acquire a range of tools to complete your jobs successfully and thoroughly. 
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Learning Environment 


Register on Sybex.com to gain access to the online interactive learning environment 
and test bank to help you study for your CEH certification - included with your 
purchase of this book! 





The online tool includes: 
e Assessment Test to help you focus your study to specific objectives 
e Chapter Tests to reinforce what you learned 
e Practice Exams to test your knowledge of the material 
e Electronic Flashcards to reinforce your learning and provide last-minute test prep 
before the exam 
e Searchable Glossary gives you instant access to the key terms you'll need to know 
for the exam 
Go to http: //sybextestbanks.wiley.com to register and gain access to this comprehensive 
study tool package. 
Do you need more? If you are the type of learner who thrives on practice tests and need 
more tests than those included with this book at sybextestbanks.wiley.com, consider 
buying Sybex’s new CEH: Certified Ethical Hacker Version 9 Practice Tests by Raymond 
Blockmon (ISBN: 978-1-119-25215-3)]. With 5 additional complete practice tests, there are 
more than enough tests for anyone to assess their readiness to sit for the CEH. 
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